Restrict Savings Plan creation outside specified subscription in Mgmt group via Azure Policy

Question

Using Terraform/Azure Policies, I want to restrict the creation of savings plans only to one of our subscriptions i.e Prod. We have more than 10 subscriptions in the tenant in different management groups.

Since Savings Plans don't have a straightforward path, I'm facing difficulties creating a policy for them.

Here's the policy I have so far:

resource "azurerm_policy_definition" "restrict_savings_plan" {
  name         = "restrict-savings-plan-creation"
  policy_type  = "Custom"
  mode         = "All"
  display_name = "Restrict Savings Plan Creation to Prod Subscription"

  policy_rule = <

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

To restrict the creation of savings plans to only one subscription (Prod) using Terraform and Azure Policies, you can define a custom policy and assign it to the specific subscription. Here's how you can complete your policy definition:

Policy Definition

resource "azurerm_policy_definition" "restrict_savings_plan" {
  name         = "restrict-savings-plan-creation"
  policy_type  = "Custom"
  mode         = "All"
  display_name = "Restrict Savings Plan Creation to Prod Subscription"

  policy_rule = <<POLICY_RULE
  {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/savingsPlans"
        },
        {
          "not": {
            "field": "subscriptionId",
            "equals": "YOUR_PROD_SUBSCRIPTION_ID"
          }
        }
      ]
    },
    "then": {
      "effect": "Deny"
    }
  }
  POLICY_RULE
}

Policy Assignment

Next, you need to assign this policy to your management group or subscription. Here's an example of how to assign it to a management group:

resource "azurerm_policy_assignment" "restrict_savings_plan_assignment" {
  name                 = "restrict-savings-plan-assignment"
  policy_definition_id = azurerm_policy_definition.restrict_savings_plan.id
  scope                = "/subscriptions/YOUR_PROD_SUBSCRIPTION_ID"
  display_name         = "Restrict Savings Plan Creation to Prod Subscription"
}

Explanation

• Policy Rule: The policy rule checks if the resource type is Microsoft.Compute/savingsPlans and if the subscription ID is not equal to your Prod subscription ID. If both conditions are met, the policy denies the creation of the savings plan.
• Policy Assignment: The policy is assigned to the specific subscription (Prod) where you want to allow the creation of savings plans.

Replace YOUR_PROD_SUBSCRIPTION_ID with the actual subscription ID of your Prod environment.

By following these steps, you can restrict the creation of savings plans to only your Prod subscription. If you have any further questions or need additional assistance, feel free to ask!

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful