Exempt Azure policy for Users in specific AD group?

Question

Hello,

Is it possible to bypass Azure policy for specific AD users or AD groups while creating objects in AKS

Answer 1

Hello @Tanul !

Can you try the following :

One way to do this is to use policy exemptions, which allow you to exclude specific resources or resource groups from policy enforcement. To create a policy exemption, you would need to create a new policy assignment with a higher priority than the policy that you want to bypass, and then configure the policy assignment to exclude the specific resources or resource groups that you want to exempt.

To exclude specific AD users or AD groups from policy enforcement, you can use the "NotIn" condition in your policy rules to exclude the user or group from the policy scope. For example, you could create a policy rule that requires AKS resources to be created in a specific resource group, but exclude a specific AD group from the policy scope:

{
    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.ContainerService/ManagedClusters"
            },
            {
                "not": {
                    "field": "tags['ExcludeFromPolicy']",
                    "equals": "True"
                }
            },
            {
                "not": {
                    "field": "owner",
                    "in": "[parameters('ExcludedADGroups')]"
                }
            }
        ]
    },
    "then": {
        "effect": "deny"
    }
}

Here, the policy rule denies the creation of AKS resources if they are not tagged with "ExcludeFromPolicy" or if the resource owner is not a member of an AD group specified in the "ExcludedADGroups" parameter.

If the Answer is helpful, please click "Accept Answer" and upvote it.

Regards

Answer 2

Hello

Then this is what you need :

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes

https://learn.microsoft.com/en-us/azure/aks/use-azure-policy?toc=%2Fazure%2Fgovernance%2Fpolicy%2Ftoc.json&bc=%2Fazure%2Fgovernance%2Fpolicy%2Fbreadcrumb%2Ftoc.json

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have further questions about this answer, please click "Comment".

Regards

Answer 3

Hello @Tanul

I thnk this link can help a lot

https://dev.to/cse/bypassing-policies-in-azure-29fc

Kindly post an update

If this heped please mark it as Accepted!

Regards

Answer 4

Hello @Tanul

Removed - No option for Principal in Policy

I am working on a solution for this

I am afraid i cannot make it happen without an integraton , for example Azure Functions

But i am not positive or negative yet

I thought that this was already there , but it is not you are right!

Funny thing , it occured to me as a need , so if you kindly can wait , in case a solution i am working now does what we need , we can both benefit !

I have a question though

The otion to lock the specific resource group so only a specific Object ID has Permissions is not acceptable ?

For example , a Resource Group where a SPECIFIC group has permissions ? or each resource group which starts with a specific prefix ?

Regards

Answer 5

Removed - Please wait for Update!