tf-module-azure-policy-allowed-region/main.tf at master · evry/tf-module-azure-policy-allowed-region · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
terraform {
  required_version = ">=0.10"
}

locals {
  environment = "${terraform.workspace == "default" ? "test" : terraform.workspace}"
}

resource "azurerm_policy_definition" "test" {
  name         = "${var.name_prefix}-allowed-regions-${local.environment}"
  policy_type  = "Custom"
  mode         = "All"
  display_name = "${var.name_prefix}-allowed-regions"

  policy_rule = <<POLICY_RULE
{
  "if": {
    "allOf": [
      {
        "field": "location",
        "notIn": "[parameters('listOfAllowedLocations')]"
      },
      {
        "field": "location",
        "notEquals": "global"
      },
      {
        "field": "type",
        "notEquals": "Microsoft.AzureActiveDirectory/b2cDirectories"
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}
POLICY_RULE

  parameters = <<PARAMETERS
    {
    "listOfAllowedLocations": {
      "type": "Array",
      "metadata": {
        "description": "The list of allowed locations for resources.",
        "displayName": "Allowed locations",
        "strongType": "location"
      }
    }
  }
PARAMETERS
}

resource "azurerm_policy_assignment" "test" {
  name                 = "${var.name_prefix}-allowed-regions-policy-${local.environment}"
  scope                = "${var.scope_of_policy_assignment}"
  policy_definition_id = "${azurerm_policy_definition.test.id}"
  description          = "Policy Assignment created via Terraform"
  display_name         = "Terraform-added allowed regions policy"

  parameters = <<PARAMETERS
{
  "listOfAllowedLocations": {
    "value": [ "${var.allowed_regions}" ]
  }
}
PARAMETERS
}