You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-machines/extensions/extensions-rmpolicy-howto-cli.md
+10-18Lines changed: 10 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ ms.custom: devx-track-azurecli
8
8
ms.author: gabsta
9
9
author: GabstaMSFT
10
10
ms.collection: linux
11
-
ms.date: 07/05/2022
11
+
ms.date: 04/11/2023
12
12
---
13
13
14
14
# Use Azure Policy to restrict extensions installation on Linux VMs
@@ -23,13 +23,9 @@ In order to restrict what extensions are available, you need to create a [rule](
23
23
24
24
This example demonstrates how to deny the installation of disallowed VM extensions by defining a rules file in Azure Cloud Shell. However, if you're working in Azure CLI locally, you can create a local file and replace the path (~/clouddrive) with the path to the file on your local file system.
25
25
26
-
In a [bash Cloud Shell](https://shell.azure.com/bash), type:
26
+
1.In a [bash Cloud Shell](https://shell.azure.com/bash) create the file `~/clouddrive/azurepolicy.rules.json` using any text editor.
27
27
28
-
```bash
29
-
vim ~/clouddrive/azurepolicy.rules.json
30
-
```
31
-
32
-
Copy and paste the following `.json` data into the file.
28
+
2. Copy and paste the following `.json` contents into the new file and save it.
33
29
34
30
```json
35
31
{
@@ -55,21 +51,15 @@ Copy and paste the following `.json` data into the file.
55
51
}
56
52
```
57
53
58
-
When you're finished, press **Esc**, and then type **:wq** to save and close the file.
59
-
60
54
## Create a parameters file
61
55
62
56
You also need a [parameters](../../governance/policy/concepts/definition-structure.md#parameters) file that creates a structure for you to use for passing in a list of the unauthorized extensions.
63
57
64
58
This example shows you how to create a parameter file for Linux VMs in Cloud Shell.
65
59
66
-
In the bash Cloud Shell opened before type:
67
-
68
-
```bash
69
-
vim ~/clouddrive/azurepolicy.parameters.json
70
-
```
60
+
1. In the bash Cloud Shell opened before, create the file ~/clouddrive/azurepolicy.parameters.json using any text editor.
71
61
72
-
Copy and paste the following `.json`data into the file.
62
+
2.Copy and paste the following `.json`contents into the new file and save it.
73
63
74
64
```json
75
65
{
@@ -83,8 +73,6 @@ Copy and paste the following `.json` data into the file.
83
73
}
84
74
```
85
75
86
-
When you're finished, press **Esc**, and then type **:wq** to save and close the file.
87
-
88
76
## Create the policy
89
77
90
78
A _policy definition_ is an object used to store the configuration that you would like to use. The policy definition uses the rules and parameters files to define the policy. Create the policy definition using [az policy definition create](/cli/azure/role/assignment).
@@ -133,10 +121,13 @@ Test the policy by creating a new VM and adding a new user.
133
121
az vm create \
134
122
--resource-group myResourceGroup \
135
123
--name myVM \
136
-
--image UbuntuLTS \
124
+
--image myImage \
137
125
--generate-ssh-keys
138
126
```
139
127
128
+
> [!NOTE]
129
+
> Replace `myResourceGroup`, `myVM` and `myImage` values accordingly.
130
+
140
131
Try to create a new user named **myNewUser** using the VM Access extension.
141
132
142
133
```azurecli-interactive
@@ -152,6 +143,7 @@ az vm user update \
152
143
```azurecli-interactive
153
144
az policy assignment delete --name 'not-allowed-vmextension-linux' --resource-group myResourceGroup
0 commit comments