Deny resource types question about community-policy

[SebastianClaesson]

Hi @Dushelov ,

I'm taking a wild guess here - This is because you most likely have mode set to Indexed and not all.
More about Azure policy mode can be found here: Azure Policy Mode

Short description - running with 'All' mode will allow the policy to parse through all the Azure resource types, whilst Indexed mode will only allow resource types that has support for Tags and Location, which in your case, the Subnet does not have, as you can double-check in the ARM / Bicep reference documentation here: Subnet docs

I've tested in my tenant with a policy I wrote to deny Microsoft.Network/virtualNetworks with child resources but allow "microsoft.sql/servers" which means for example "microsoft.sql/servers/databases" so I can create a server and then all the databases needed on that.

{
  "properties": {
    "displayName": "Allowed parent with child resource types",
    "policyType": "Custom",
    "mode": "All",
    "metadata": {
      "version": "1.0.0",
      "category": "General"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "Audit",
          "Disabled",
          "Deny"
        ],
        "defaultValue": "Audit"
      },
      "resourceType": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed resource type",
          "description": "An array containing parent resource types"
        },
        "defaultValue": [
          "microsoft.network/privatednszones",
          "microsoft.sql/servers",
          "microsoft.compute/disks",
          "microsoft.compute/virtualmachines",
          "microsoft.compute/virtualmachinescalesets",
          "microsoft.containerservice/managedclusters",
          "microsoft.devtestlab/schedules",
          "microsoft.managedidentity/userassignedidentities",
          "microsoft.network/firewallpolicies",
          "microsoft.network/loadbalancers",
          "microsoft.network/networkinterfaces",
          "microsoft.network/networksecuritygroups",
          "microsoft.network/networkwatchers",
          "microsoft.network/publicipaddresses",
          "microsoft.network/routetables",
          "microsoft.storage/storageaccounts",
          "microsoft.resources/subscriptions",
          "microsoft.authorization/policyassignments",
          "microsoft.authorization/policydefinitions",
          "microsoft.authorization/roleassignments",
          "microsoft.authorization/roledefinitions",
          "microsoft.security/pricings",
          "microsoft.policyinsights/remediations"
        ]
      }
    },
    "policyRule": {
      "if": {
        "value": "[concat(split(field('type'),'/')[0],'/',split(field('type'),'/')[1])]",
        "notin": "[parameters('resourceType')]"
      },
      "then": {
        "effect": "[parameters('effect')]"
      }
    }
  }
}

[techlake]

Question has been answered; closing.