How to enforce a Tag value on an optional Tag

Question

hello, I want to create an Azure Policy to define the value of a tag, but the tag itself should be optional and not mandatory. Does anybody know if this is possible?

Answer 1

@Andreas Tratter I've added a new answer to address the issues you found.

{
  "properties": {
    "displayName": "Enforce Predefined Environment Tag Rule",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {
      "tagName": {
        "type": "String",
        "metadata": {
          "displayName": "Tag Name",
          "description": "Name of the tag, such as 'environment'"
        },
        "defaultValue": "environment"
      },
      "listofallowedtagValues": {
        "type": "Array",
        "metadata": {
          "displayName": "Tag Values",
          "description": "Value of the tag, such as 'production'"
        },
        "defaultValue": [
          "Development",
          "Test",
          "Production"
        ]
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "exists": true
          },
          {
            "not": {
              "field": "[concat('tags[', parameters('tagName'), ']')]",
              "in": "[parameters('listofallowedtagValues')]"
            }
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/xxxxxxx-xxxxxxx-xxxxxxxxxx-xxxxxxx",
  "name": "xxxxxxx-xxxxxxx-xxxxxxxxxx-xxxxxxx",
  "type": "Microsoft.Authorization/policyDefinitions",
}

Create the assignment as

And when you add the customer tag, it should result in

Answer 2

Hi @Andreas Tratter
I take you're using something like New-AzTag to create the predefined tags. If you want to enforce specific tag values, you could look at doing something like the following:

{
  "properties": {
    "displayName": "Allowed tag values for Resource Groups",
    "description": "This policy restricts the tag values for Resource Groups.",
    "policyType": "Custom",
    "mode": "Indexed",
    "metadata": {
      "version": "1.0.0",
      "category": "Tags"
    },
    "parameters": {
      "allowedTagValues": {
        "type": "array",
        "metadata": {
          "description": "The list of tag values that can be specified when deploying resource groups",
          "displayName": "Allowed tag values"
        },
        "defaultValue": [
          "Development",
          "Test",
          "Production"
        ]
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions/resourceGroups"
          },
          {
            "field": "tags[Environment]",
            "notIn": "[parameters('allowedTagValues')]"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/xxxxxxx-xxxxxxx-xxxxxxxxxx-xxxxxxx",
  "name": "xxxxxxx-xxxxxxx-xxxxxxxxxx-xxxxxxx"
}

What this policy does limit the values for a tag named Environment. But I don't believe Policy supports getting that tag list dynamically. Meaning, that you would have to get those tags and incorporate them into the list. I also found a similar question over on a stackoverflow that you can reference as well.