Skip to content

Commit 34718be

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #235233 from kenieva/PolicySDP
Add Policy Safe Deployment documentation.
2 parents 06d62fd + b14c957 commit 34718be

File tree

4 files changed

+141
-0
lines changed

4 files changed

+141
-0
lines changed

‎articles/governance/policy/how-to/policy-safe-deployment-practices.md

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
title: Safe deployment of Azure Policy assignments
3+
description: Learn how to apply the safe deployment practices (SDP) framework to your Azure Policy assignments.
4+
author: timwarner-msft
5+
ms.date: 11/14/2022
6+
ms.topic: conceptual
7+
ms.author: timwarner
8+
---
9+
# Safe deployment of Azure Policy assignments
10+
11+
As your environment expands, so does the demand for a controlled continuous deployment (CD)
12+
pipeline with progressive exposure control. Accordingly, Microsoft recommends DevOps teams follow
13+
the safe deployment practices (SDP) framework. The
14+
safe deployment of Azure Policy definitions and assignments helps limiting the impact of
15+
unintended behaviors of policy resources.
16+
17+
The high-level approach of implementing SDP with Azure Policy is to roll out policy assignments
18+
by rings to detect policy changes that affect the environment in early stages before it
19+
affects the critical cloud infrastructure.
20+
21+
Deployment rings can be organized in diverse ways. In this how-to tutorial, rings are divided by
22+
different Azure regions with _Ring 0_ representing non-critical, low traffic locations
23+
and _Ring 5_ denoting the most critical, highest traffic locations.
24+
25+
## Steps for safe deployment of Azure Policy assignments with deny or append effects
26+
27+
Use the following flowchart as a reference as we work through how to apply the SDP framework to Azure
28+
Policy assignments that use the `deny` or `append` policy effects.
29+
30+
> [!NOTE]
31+
> To learn more about Azure policy effects, see [Understand how effects work](../concepts/effects.md).
32+
33+
:::image type="content" source="safe-deployment-practices-flowchart-1.png" alt-text="Flowchart with steps one through eight showing safe deployment practices deployment of a new Azure Policy definition." border="true":::
34+
35+
1. Begin the release by creating a policy definition at the highest designated Azure management scope.
36+
We recommend storing Azure Policy definitions at the management group scope for maximum flexibility.
37+
38+
2. Once you've created your policy definition, assign the policy at the highest-level scope inclusive
39+
of all deployment rings. Apply _resource selectors_ to narrow the applicability to the least
40+
critical ring by using the `"kind": "resource location"` property. Configure the `audit` effect type
41+
by using _assignment overrides_. Sample selector with eastUS location and effect as audit
42+
43+
```json
44+
"resourceSelectors": [{
45+
"name": "SDPRegions",
46+
"selectors": [{
47+
"kind": "resourceLocation",
48+
"in": [ "eastUS" ]
49+
}]
50+
}],
51+
"overrides":[{
52+
"kind": "policyEffect",
53+
"value": "Audit"
54+
}]
55+
```
56+
57+
3. Once the assignment is deployed and the initial compliance scan has completed,
58+
validate that the compliance result is as expected.
59+
60+
You should also configure automated tests that run compliance checks. A compliance check should
61+
encompass the following logic:
62+
63+
- Gather compliance results
64+
- If compliance results are as expected, the pipeline should continue
65+
- If compliance results aren't as expected, the pipeline should fail and you should start debugging
66+
67+
For example, you can configure the compliance check by using other tools within
68+
your particular continuous integration/continuous deployment (CI/CD) pipeline.
69+
70+
At each rollout stage, the application health checks should confirm the stability of the service
71+
and impact of the policy. If the results aren't as expected due to application configuration,
72+
refactor the application as appropriate.
73+
74+
4. Repeat by expanding the resource selector property values to include the next rings’
75+
locations and validating the expected compliance results and application health. Example selector with an added location value:
76+
77+
```json
78+
"resourceSelectors": [{
79+
"name": "SDPRegions",
80+
"selectors": [{
81+
"kind": "resourceLocation",
82+
"in": [ "eastUS", "westUS"]
83+
}]
84+
}]
85+
```
86+
87+
5. Once you have successfully assigned the policy to all rings using `audit` mode,
88+
the pipeline should trigger a task that changes the policy effect to `deny` and reset
89+
the resource selectors to the location associated with _Ring 0_. Example selector with one region and effect set to deny:
90+
91+
```json
92+
"resourceSelectors": [{
93+
"name": "SDPRegions",
94+
"selectors": [{
95+
"kind": "resourceLocation",
96+
"in": [ "eastUS" ]
97+
}]
98+
}],
99+
"overrides":[{
100+
"kind": "policyEffect",
101+
"value": "Deny"
102+
}]
103+
```
104+
105+
6. Once the effect is changed, automated tests should check whether enforcement is taking place as
106+
expected.
107+
108+
7. Repeat by including more rings in your resource selector configuration.
109+
110+
8. Repeat this process for all production rings.
111+
112+
## Steps for safe deployment of Azure Policy assignments with modify or deployIfNotExists effects
113+
114+
Steps 1-4 for policies using the `modify` or `deployIfNotExists` effects are the same as steps previously explained.
115+
Review the following flowchart with modified steps 5-9:
116+
117+
:::image type="content" source="safe-deployment-practices-flowchart-2.png" alt-text="Flowchart showing steps 5 through 9 in the Azure Policy safe deployment practices workflow." border="true":::
118+
119+
5. Once you've assigned the policy to all rings using `audit` mode, the pipeline should trigger
120+
a task that changes the policy effect to `modify` or `deployIfNotExists` and resets
121+
the resource selectors to _Ring 0_.
122+
123+
6. Automated tests should then check whether the enforcement works as expected.
124+
125+
7. The pipeline should trigger a remediation task that corrects existing resources in that given ring.
126+
127+
8. After the remediation task is complete, automated tests should verify the remediation works
128+
as expected using compliance and application health checks.
129+
130+
9. Repeat by including more locations in your resource selector configuration. Then repeat all for production rings.
131+
132+
> [!NOTE]
133+
> For more information on Azure policy remediation tasks, read [Remediate non-compliant resources with Azure Policy](./remediate-resources.md).
134+
## Next steps
135+
136+
- Learn how to [programmatically create policies](./programmatically-create.md)
137+
- Review [Azure Policy as code workflows](../concepts/policy-as-code.md)
138+
- Study Microsoft's guidance concerning [safe deployment practices](/devops/operate/safe-deployment-practices)

‎articles/governance/policy/how-to/safe-deployment-practices-flowchart-1.png

58.4 KB
Loading

‎articles/governance/policy/how-to/safe-deployment-practices-flowchart-2.png

46 KB
Loading

‎articles/governance/policy/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,9 @@
236236
href: /security/benchmark/azure/baselines/azure-policy-security-baseline?toc=/azure/governance/policy/toc.json&bc=/azure/governance/policy/breadcrumb/toc.json
237237
- name: How-to guides
238238
items:
239+
- name: Safe deployment of Azure Policy assignments
240+
displayName: policy, assignments, sdp
241+
href: ./how-to/policy-safe-deployment-practices.md
239242
- name: Azure Policy extension for VS Code
240243
displayName: visual studio code
241244
href: ./how-to/extension-for-vscode.md

0 commit comments

Comments
 (0)