Azure Policy for DeployIfNotExists for Key Vault not working as expected about community-policy

[techlake]

I do not have a great test bed. Can you try/test the following in your environment:

{
  "name": "1b8dc472-9716-414a-9328-9f34f4e00d67",
  "type": "Microsoft.Authorization/policyDefinitions",
  "properties": {
    "displayName": "Enable soft-delete and purge protection on Key Vaults",
    "description": "This Policy will enable soft-delete and purge protection on all Key Vaults.",
    "metadata": {
      "category": "Key Vault",
      "version": "1.0.0"
    },
    "mode": "All",
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Modify, Deny, Audit, or Disabled"
        },
        "allowedValues": [
          "Modify",
          "Deny",
          "Audit",
          "Disabled"
        ],
        "defaultValue": "DeployIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.KeyVault/vaults"
          },
          {
            "anyOf": [
              {
                "field": "enableSoftDelete",
                "exists": "false"
              },
              {
                "field": "enablePurgeProtection",
                "exists": "false"
              },
              {
                "field": "enablePurgeProtection",
                "equals": "false"
              },
              {
                "field": "enableSoftDelete",
                "equals": "false"
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/f25e0fa2-a7c8-4377-a976-54943a77a395"
          ],
          "operations": [
            {
              "operation": "addOrReplace",
              "field": "enableSoftDelete",
              "value": "true"
            },
            {
              "operation": "addOrReplace",
              "field": "enablePurgeProtection",
              "value": "true"
            }
          ]
        }
      }
    }
  }
}

[techlake]

PS: I gave it a new GUID to prevent conflicts.

[TusharNagar211]

Unfortunately it does not work.
For the above definition, the field enablePurgeProtection or enableSoftDelete do not exists
If I replace it with Microsoft.KeyVault/vaults/enablePurgeProtection then it says:
The policy definition '""' has operations that modify aliases with values that are not supported: 'Microsoft.KeyVault/vaults/enableSoftDelete' does not support values of type: 'String'. Only 'Boolean' values are supported,'Microsoft.KeyVault/vaults/enablePurgeProtection' does not support values of type: 'String'. Only 'Boolean' values are supported.

[TusharNagar211]

Also do you think that the deployifNotExist will not show the compliance status for resources remediated and the resources newly created?

[techlake]

Try removing the "" around the true values in the "addRemove" section. It is likely that the quotes are good in the if section (don't ask :-))

On your second question: yes, they do show as compliant if remediated (either new resource DINEd, or remediation task run)

[getazcloud]

Hi,
I tried this one and it worked for me.

            "then": {
                "effect": "modify",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/Microsoft.Authorization/roleDefinitions/f25e0fa2-a7c8-4377-a976-54943a77a395"
                    ],
                    "operations": [
                        {
                            "operation": "addOrReplace",
                            "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
                            "value": true
                        },
                        {
                            "operation": "addOrReplace",
                            "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
                            "value": true
                        }
                    ]
                }
            }

[techlake]

Great. I'll fix this and commit it

[techlake]

To confirm. Is this what you are using?

{
  "name": "1b8dc472-9716-414a-9328-9f34f4e00d67",
  "type": "Microsoft.Authorization/policyDefinitions",
  "properties": {
    "displayName": "Enable soft-delete and purge protection on Key Vaults",
    "description": "This Policy will enable soft-delete and purge protection on all Key Vaults.",
    "metadata": {
      "category": "Key Vault",
      "version": "2.0.0"
    },
    "mode": "All",
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Modify, Deny, Audit, or Disabled"
        },
        "allowedValues": [
          "Modify",
          "Deny",
          "Audit",
          "Disabled"
        ],
        "defaultValue": "Modify"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.KeyVault/vaults"
          },
          {
            "anyOf": [
              {
                "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
                "exists": "false"
              },
              {
                "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
                "exists": "false"
              },
              {
                "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
                "equals": "false"
              },
              {
                "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
                "equals": "false"
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/f25e0fa2-a7c8-4377-a976-54943a77a395"
          ],
          "operations": [
            {
              "operation": "addOrReplace",
              "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
              "value": true
            },
            {
              "operation": "addOrReplace",
              "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
              "value": true
            }
          ]
        }
      }
    }
  }
}

[getazcloud]

@techlake yes that is the one. Just tested the purge protection, because didn't have any KV with enableSoftDelete set to false

[techlake]

Did it work?