You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Policy _assignments_ are created from built-in policy _definitions_. Assignments are scoped to an Azure management group, an Azure subscription, or a resource group and will apply to resources within the scope. Optionally, specific resources can be excluded from the scope.
21
21
22
-
Policy assignments can be created with the [Azure Portal](../governance/policy/assign-policy-portal.md), [Azure Powershell](../governance/policy/assign-policy-portal.md), [Azure CLI](../governance/policy/assign-policy-portal.md), or [ARM template](../governance/policy/assign-policy-portal.md).
22
+
Policy assignments can be created with the [Azure portal](../governance/policy/assign-policy-portal.md), [Azure PowerShell](../governance/policy/assign-policy-powershell.md), [Azure CLI](../governance/policy/assign-policy-azurecli.md), or [ARM template](../governance/policy/assign-policy-template.md).
23
23
24
-
To create a policy assignment from a built-in policy definition for Cosmos DB, follow the steps to [create a policy assignment with the Azure Portal](../governance/policy/assign-policy-portal.md).
24
+
To create a policy assignment from a built-in policy definition for Cosmos DB, follow the steps to [create a policy assignment with the Azure portal](../governance/policy/assign-policy-portal.md).
25
25
26
-
At the step to select a policy definition, enter `Cosmos DB` in the Search field. This will filter the list of available built-in policy definitions. Select one of the available built-in policy definitions, then the **Select** button to continue with policy assignment creation.
26
+
At the step to select a policy definition, and enter `Cosmos DB` in the Search field to filter the list of available built-in policy definitions. Select one of the available built-in policy definitions, then the **Select** button to continue with policy assignment creation.
27
27
28
28
> [!TIP]
29
-
> The built-in policy definition names shown on **Available Definitions** can also be used with Azure Powershell, Azure CLI, or ARM templates to create policy assignments.
29
+
> The built-in policy definition names shown on **Available Definitions** can also be used with Azure PowerShell, Azure CLI, or ARM templates to create policy assignments.
30
30
31
31
:::image type="content" source="./media/policy/available-definitions.png" alt-text="Search for Cosmos DB built-in policy definitions":::
32
32
@@ -75,7 +75,7 @@ The output of listing Cosmos DB property aliases using one of the methods descri
75
75
76
76
Any of these property alias names can be used in [custom policy definition rules](../governance/policy/tutorials/create-custom-policy-definition#policy-rule).
77
77
78
-
For example, to create a policy to check if a Cosmos DB SQL database's provisioned throughput is greater than a maximum allowable limit of 400 RU/s, a custom policy definition would include two rules: one to check for the specific type to check, and one for the specific property of the type. Both rules would use alias names.
78
+
An examplepolicy can check if a Cosmos DB SQL database's provisioned throughput is greater than a maximum allowable limit of 400 RU/s. A custom policy definition would include two rules: one to check for the specific type to check, and one for the specific property of the type. Both rules would use alias names.
79
79
80
80
```json
81
81
"policyRule": {
@@ -94,22 +94,22 @@ For example, to create a policy to check if a Cosmos DB SQL database's provision
94
94
}
95
95
```
96
96
97
-
Once a custom policy definition is saved, it can be used similarly to built-in policy definitions to create policy assignments.
97
+
Built-in and custom policy definitions can be used similarly to create policy assignments.
98
98
99
99
## Policy Compliance
100
100
101
-
After policy assignments are created, Azure Policy evaluates the resources in the policy assignment's scope and assesses each resource's _compliance_ with the policy, applying the _effect_ specified in the policy to non-compliant resources.
101
+
After policy assignments are created, Azure Policy evaluates the resources in the assignment's scope. Each resource's _compliance_ with the policy is assessed. The _effect_ specified in the policy is then applied to non-compliant resources.
102
102
103
103
Compliance results and remediation details can be reviewed in the [Azure portal](../governance/policy/how-to/get-compliance-data#portal) or via the [Azure CLI](../governance/policy/how-to/get-compliance-data#command-line) or [Azure Monitor logs](../governance/policy/how-to/get-compliance-data#azure-monitor-logs).
104
104
105
-
In the following example, two policy assignments were created. One policy assignment was created from a built-in policy definition to check that Azure Cosmos DB resources were deployed only to an allowed list of Azure regions. The other policy assignment was created from a custom policy definition to check that provisioned throughput on Azure Cosmos DB resources does not exceed a specified maximum.
105
+
Two examplepolicy assignments are shown. One assignment, based on a built-in policy definition, checks that Azure Cosmos DB resources are deployed only to allowed Azure regions. The other assignment is based on a custom policy definition. This assignment checks that provisioned throughput on Azure Cosmos DB resources does not exceed a specified maximum.
106
106
107
-
After the policy assignments were deployed, the compliance dashboard shows evaluation results (note that this can take up to 30 minutes after policy assignment deployment).
107
+
After the policy assignments were deployed, the compliance dashboard shows evaluation results. Note that this can take up to 30 minutes after policy assignment deployment.
108
108
109
109
The screenshot shows the following compliance evaluation results:
110
110
111
-
-0 of 1 Azure Cosmos DB accounts in scope are compliant with the policy assignment to check that resources were deployed to allowed regions
112
-
-1 of 2 Azure Cosmos DB database or collection resources in scope are compliant with the policy assignment to check for provisioned throughput exceeding the specified maximum
111
+
-Zero of one Azure Cosmos DB accounts in scope are compliant with the policy assignment to check that resources were deployed to allowed regions
112
+
-One of two Azure Cosmos DB database or collection resources in scope are compliant with the policy assignment to check for provisioned throughput exceeding the specified maximum
113
113
114
114
:::image type="content" source="./media/policy/compliance.png" alt-text="Search for Cosmos DB built-in policy definitions":::
115
115
@@ -118,5 +118,5 @@ Non-compliant resources can be [remediated with Azure Policy](../governance/poli
118
118
## Next Steps
119
119
120
120
-[Review sample custom policy definitions for Azure Cosmos DB](https://github.com/Azure/azure-policy/tree/master/samples/CosmosDB)
121
-
-[Create a policy assignment in the Azure Portal](../governance/policy/assign-policy-portal)
121
+
-[Create a policy assignment in the Azure portal](../governance/policy/assign-policy-portal)
122
122
-[Review Azure Policy built-in policy definitions for Azure Cosmos DB](./policy-samples.md)
0 commit comments