How do I govern subresources in ResourceProviders?

Question

There is AuditIfNotExists policy like below

"policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.DBforPostgreSQL/servers"
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.DBforPostgreSQL/servers/configurations",
          "name": "log_checkpoints",
          "existenceCondition": {
            "field": "Microsoft.DBforPostgreSQL/servers/configurations/value",
            "equals": "ON"
          }
        }
      }
    }
  },

How do I makes sure that log_checkpoints is always ON and nobody can deploy resource with this value being OFF or change existing resource from ON to OFF?

Answer 1

Unfortunately, we do not support "deny" for data plane level resources at the moment. I would suggest adding this to our UserVoice. Thanks.