Skip to content

Commit d750b77

Browse files
kenievakenieva
committed
Add Safe Deployment documentation
1 parent d3f4486 commit d750b77

File tree

4 files changed

+140
-0
lines changed

4 files changed

+140
-0
lines changed

‎articles/governance/policy/how-to/policy-safe-deployment-practices.md

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
---
2+
title: Safe deployment of Azure Policy assignments
3+
description: Learn how to apply the safe deployment practices (SDP) framework to your Azure Policy assignments.
4+
author: timwarner-msft
5+
ms.date: 11/14/2022
6+
ms.topic: conceptual
7+
ms.author: timwarner
8+
---
9+
# Safe deployment of Azure Policy assignments
10+
11+
As your environment expands, so does the demand for a controlled continuous deployment (CD)
12+
pipeline with progressive exposure control. Accordingly, Microsoft recommends DevOps teams follow
13+
the safe deployment practices (SDP) framework. The
14+
safe deployment of Azure Policy definitions and assignments assists in limiting the impact of
15+
unintended behaviors of policy resources.
16+
17+
The high-level approach of implementing SDP with Azure Policy is to roll out policy assignments
18+
by rings to detect policy changes that affect the environment in early stages before it
19+
affects the critical cloud infrastructure.
20+
21+
Deployment rings can be organized in diverse ways. In this how-to tutorial, rings are divided by
22+
different Azure regions with _Ring 0_ representing critical, low traffic locations
23+
and _Ring 5_ denoting the most critical, highest traffic locations.
24+
25+
## Steps for safe deployment of Azure Policy assignments with deny or append effects
26+
27+
Use the following flowchart as a reference as we work through how to apply the SDP framework to Azure
28+
Policy assignments that use the `deny` or `append` policy effects.
29+
30+
> [!NOTE]
31+
> To learn more about Azure policy effects, see [Understand how effects work](../concepts/effects.md).
32+
:::image type="content" source="safe-deployment-practices-flowchart1.png" alt-text="Flowchart with steps one through eight showing safe deployment practices deployment of a new Azure Policy definition." border="true":::
33+
34+
1. Begin the release by creating a policy definition at the highest designated Azure management scope.
35+
We recommend storing Azure Policy definitions at the management group scope for maximum flexibility.
36+
37+
2. Once you've created your policy definition, assign the policy at the highest-level scope inclusive
38+
of all deployment rings. Leverage _resource selectors_ to narrow the applicability to the least
39+
critical ring by using the `"kind": "resource location"` property. Configure the `audit` effect type
40+
by using _assignment overrides_. Sample selector with eastUS location and effect as audit
41+
42+
```json
43+
"resourceSelectors": [{
44+
"name": "SDPRegions",
45+
"selectors": [{
46+
"kind": "resourceLocation",
47+
"in": [ "eastUS" ]
48+
}]
49+
}],
50+
"overrides":[{
51+
"kind": "policyEffect",
52+
"value": "Audit"
53+
}]
54+
```
55+
56+
3. Once the assignment is deployed and the initial compliance scan has completed,
57+
validate that the compliance result is as expected.
58+
59+
You should also configure automated tests that run compliance checks. A compliance check should
60+
encompass the following logic:
61+
62+
- Gather compliance results
63+
- If compliance results are as expected, the pipeline should continue
64+
- If compliance results are not as expected, the pipeline should fail and you should start debugging
65+
66+
For example, you can configure the compliance check by using other tools within
67+
your particular continuous integration/continuous deployment (CI/CD) pipeline.
68+
69+
At each rollout stage, the application health checks should confirm the stability of the service
70+
and impact of the policy. If the results are not as expected due to application configuration,
71+
refactor the application as appropriate.
72+
73+
4. Repeat by expanding the resource selector property values to include the next rings’
74+
locations and validating the expected compliance results and application health. Example selector with an added location value:
75+
76+
```json
77+
"resourceSelectors": [{
78+
"name": "SDPRegions",
79+
"selectors": [{
80+
"kind": "resourceLocation",
81+
"in": [ "eastUS", "westUS"]
82+
}]
83+
}]
84+
```
85+
86+
5. Once you've successfully assigned the policy to all rings using `audit` mode,
87+
the pipeline should trigger a task that changes the policy effect to `deny` and reset
88+
the resource selectors to the location associated with _Ring 0_. Example selector with one region and effect set to deny:
89+
90+
```json
91+
"resourceSelectors": [{
92+
"name": "SDPRegions",
93+
"selectors": [{
94+
"kind": "resourceLocation",
95+
"in": [ "eastUS" ]
96+
}]
97+
}],
98+
"overrides":[{
99+
"kind": "policyEffect",
100+
"value": "Deny"
101+
}]
102+
```
103+
104+
6. After changing the effect, automated tests should check whether enforcement is taking place as
105+
expected.
106+
107+
7. Repeat by including more rings in your resource selector configuration.
108+
109+
8. Repeat this process for all production rings.
110+
111+
## Steps for safe deployment of Azure Policy assignments with modify or deployIfNotExists effects
112+
113+
Steps 1-4 for policies using the `modify` or `deployIfNotExists` effects are the same as above.
114+
Study the following flowchart and then review modified steps 5-9:
115+
116+
:::image type="content" source="safe-deployment-practices-flowchart2.png" alt-text="Flowchart showing steps five through nine in the Azure Policy safe deployment practices workflow." border="true":::
117+
118+
5. Once you've assigned the policy to all rings using `audit` mode, the pipeline should trigger
119+
a task that changes the policy effect to `modify` or `deployIfNotExists` and resets
120+
the resource selectors to _Ring 0_.
121+
122+
6. Automated tests should then check whether the enforcement works as expected.
123+
124+
7. The pipeline should trigger a remediation task that corrects existing resources in that given ring.
125+
126+
8. After the remediation task is complete, automated tests should verify the remediation works
127+
as expected using compliance and application health checks.
128+
129+
9. Repeat by including more locations in your resource selector configuration. Then repeat all for production rings.
130+
131+
> [!NOTE]
132+
> For more information on Azure policy remediation tasks, read [Remediate non-compliant resources with Azure Policy](./remediate-resources.md).
133+
## Next steps
134+
135+
- Learn how to [programmatically create policies](./programmatically-create.md)
136+
- Review [Azure Policy as code workflows](../concepts/policy-as-code.md)
137+
- Study Microsoft's guidance concerning [safe deployment practices](/devops/operate/safe-deployment-practices)

‎articles/governance/policy/how-to/safe-deployment-practices-flowchart1.png

58.4 KB
Loading

‎articles/governance/policy/how-to/safe-deployment-practices-flowchart2.png

46 KB
Loading

‎articles/governance/policy/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,9 @@
236236
href: /security/benchmark/azure/baselines/azure-policy-security-baseline?toc=/azure/governance/policy/toc.json&bc=/azure/governance/policy/breadcrumb/toc.json
237237
- name: How-to guides
238238
items:
239+
- name: Safe deployment of Azure Policy assignments
240+
displayName: policy, assignments, sdp
241+
href: ./how-to/policy-safe-deployment-practices.md
239242
- name: Azure Policy extension for VS Code
240243
displayName: visual studio code
241244
href: ./how-to/extension-for-vscode.md

0 commit comments

Comments
 (0)