28 Jul Compliance with Azure Policy Using PowerShell

Intro

As organizations increasingly adopt cloud services, ensuring compliance with security standards becomes critical. Azure Policy provides a robust framework for managing and enforcing policies across Azure resources. By leveraging PowerShell, you can automate the creation, assignment, and monitoring of Azure Policies, ensuring that your environment remains compliant and secure. This blog post will guide you through automating compliance with Azure Policy using PowerShell.

What is Azure Policy?

Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce rules and effects over your resources, ensuring that they comply with your corporate standards and service-level agreements (SLAs). Azure Policy helps in maintaining compliance and governance by evaluating resources against these policies and providing insights into compliance status.

Key Features of Azure Policy

1. Policy Definition: Define policies to enforce specific rules and effects.
2. Initiative Definition: Group multiple policy definitions into a single unit for simplified management.
3. Policy Assignment: Assign policies to specific scopes such as subscriptions, resource groups, or resources.
4. Compliance Evaluation: Continuously evaluate resources against the assigned policies and provide compliance reports.

Automating Azure Policy with PowerShell

PowerShell provides a powerful and flexible way to automate Azure Policy management. Below are the steps to automate the creation, assignment, and monitoring of Azure Policies using PowerShell.

Step 1: Connect to Azure

Before managing Azure Policy with PowerShell, you need to connect to your Azure account.

# Connect to Azure
Connect-AzAccount

Step 2: Creating a Policy Definition

A policy definition specifies the condition under which it is enforced and the effect it takes. In this example, we’ll create a policy to enforce that all storage accounts must use secure transfer.

# Define policy parameters
$policyDefinitionName = "EnforceSecureTransfer"
$policyDisplayName = "Enforce Secure Transfer on Storage Accounts"
$policyDescription = "Ensures that all storage accounts have secure transfer enabled."
$policyRule = @{
    "if" = @{
        "field" = "Microsoft.Storage/storageAccounts/enableHttpsTrafficOnly"
        "equals" = "false"
    }
    "then" = @{
        "effect" = "deny"
    }
}

# Create the policy definition
$policyDefinition = New-AzPolicyDefinition -Name $policyDefinitionName -DisplayName $policyDisplayName -Description $policyDescription -Policy $policyRule

Step 3: Assigning a Policy

Once the policy definition is created, you can assign it to a specific scope, such as a subscription or resource group. Here, we’ll assign the policy to a resource group.

# Define assignment parameters
$assignmentName = "EnforceSecureTransferAssignment"
$resourceGroupName = "GarsonResourceGroup"

# Assign the policy to the resource group
New-AzPolicyAssignment -Name $assignmentName -Scope "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName" -PolicyDefinition $policyDefinition

Step 4: Creating and Assigning an Initiative

An initiative definition is a collection of policy definitions that can be assigned as a single unit. This simplifies the management of multiple policies. Here, we’ll create an initiative that includes the previously defined policy.

# Define initiative parameters
$initiativeName = "StorageSecurityInitiative"
$initiativeDisplayName = "Storage Security Initiative"
$initiativeDescription = "Ensures compliance with storage security policies."
$policyDefinitions = @($policyDefinition)

# Create the initiative definition
$initiative = New-AzPolicySetDefinition -Name $initiativeName -DisplayName $initiativeDisplayName -Description $initiativeDescription -PolicyDefinition $policyDefinitions

# Assign the initiative to a resource group
New-AzPolicyAssignment -Name "$initiativeName-Assignment" -Scope "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName" -PolicySetDefinition $initiative

Step 5: Monitoring Compliance

Azure Policy continuously evaluates resources against the assigned policies and provides compliance reports. You can use PowerShell to retrieve and monitor the compliance state.

# Get compliance state for a specific policy assignment
$complianceState = Get-AzPolicyState -PolicyAssignmentName $assignmentName
$complianceState.Value | ForEach-Object {
    Write-Output "Resource: $($_.ResourceId) - Compliance State: $($_.ComplianceState)"
}

# Get overall compliance state for the subscription
$overallComplianceState = Get-AzPolicyState
$overallComplianceState.Value | ForEach-Object {
    Write-Output "Policy: $($_.PolicyDefinitionName) - Compliance State: $($_.ComplianceState)"
}

If you wish to start you journey from beggining check out how to start with Powershell in Azure: