{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/azure-policy/issues/229","repository_url":"https://api.github.com/repos/Azure/azure-policy","labels_url":"https://api.github.com/repos/Azure/azure-policy/issues/229/labels{/name}","comments_url":"https://api.github.com/repos/Azure/azure-policy/issues/229/comments","events_url":"https://api.github.com/repos/Azure/azure-policy/issues/229/events","html_url":"https://github.com/Azure/azure-policy/issues/229","id":372055795,"node_id":"MDU6SXNzdWUzNzIwNTU3OTU=","number":229,"title":"Alias Request: Microsoft.Authorization/Locks.Level","user":{"login":"AErmie","id":10376796,"node_id":"MDQ6VXNlcjEwMzc2Nzk2","avatar_url":"https://avatars0.githubusercontent.com/u/10376796?v=4","gravatar_id":"","url":"https://api.github.com/users/AErmie","html_url":"https://github.com/AErmie","followers_url":"https://api.github.com/users/AErmie/followers","following_url":"https://api.github.com/users/AErmie/following{/other_user}","gists_url":"https://api.github.com/users/AErmie/gists{/gist_id}","starred_url":"https://api.github.com/users/AErmie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AErmie/subscriptions","organizations_url":"https://api.github.com/users/AErmie/orgs","repos_url":"https://api.github.com/users/AErmie/repos","events_url":"https://api.github.com/users/AErmie/events{/privacy}","received_events_url":"https://api.github.com/users/AErmie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-19T17:53:22Z","updated_at":"2018-11-14T13:38:46Z","closed_at":null,"author_association":"NONE","body":"**Scenario**\r\nEnable the ability to create a Policy to audit if Resource Groups labelled with a specific Tag (i.e. \"Env:PROD\") has a Resource Lock applied to it. \r\n\r\nThe challenge with creating a definition for this is that the Resource Lock has a custom name, so we need a wildcard placeholder. \r\n\r\nThe [ARM template](https://docs.microsoft.com/en-us/azure/templates/microsoft.authorization/locks) shows the Level referenced within the Properties object, but the example of how to use [Aliases in Policies](https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure#understanding-the--alias) by using the wildcard.property (i.e. [*].property) is not accepted in the Policy.\r\n\r\n**Definition**\r\n```\r\n{\r\n  \"mode\": \"all\",\r\n  \"policyRule\": {\r\n    \"if\": {\r\n      \"allOf\": [\r\n        {\r\n          \"field\": \"type\",\r\n          \"equals\": \"Microsoft.Resources/subscriptions/resourceGroups\"\r\n        },\r\n        {\r\n          \"field\": \"[concat('tags[', parameters('tagName'), ']')]\",\r\n          \"equals\": \"[parameters('tagValue')]\"\r\n        },\r\n        {\r\n          \"field\": \"Microsoft.Authorization/locks/[*]/level\",\r\n          \"equals\": \"CanNotDelete\"\r\n        }\r\n      ]\r\n    },\r\n    \"then\": {\r\n      \"effect\": \"audit\"\r\n    }\r\n  },\r\n  \"parameters\": {\r\n    \"tagName\": {\r\n      \"type\": \"String\",\r\n      \"metadata\": {\r\n        \"displayName\": \"Tag Name\",\r\n        \"description\": \"The Tag namne to audit against (i.e. Environment, CostCenter, etc.)\"\r\n      }\r\n    },\r\n    \"tagValue\": {\r\n      \"type\": \"String\",\r\n      \"metadata\": {\r\n        \"displayName\": \"Tag Value\",\r\n        \"description\": \"Value of the tag to audit against (i.e. Prod/UAT/TEST, 12345, etc.)\"\r\n      }\r\n    }\r\n  }\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/Azure/azure-policy/issues/comments/438664506","html_url":"https://github.com/Azure/azure-policy/issues/229#issuecomment-438664506","issue_url":"https://api.github.com/repos/Azure/azure-policy/issues/229","id":438664506,"node_id":"MDEyOklzc3VlQ29tbWVudDQzODY2NDUwNg==","user":{"login":"AErmie","id":10376796,"node_id":"MDQ6VXNlcjEwMzc2Nzk2","avatar_url":"https://avatars0.githubusercontent.com/u/10376796?v=4","gravatar_id":"","url":"https://api.github.com/users/AErmie","html_url":"https://github.com/AErmie","followers_url":"https://api.github.com/users/AErmie/followers","following_url":"https://api.github.com/users/AErmie/following{/other_user}","gists_url":"https://api.github.com/users/AErmie/gists{/gist_id}","starred_url":"https://api.github.com/users/AErmie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AErmie/subscriptions","organizations_url":"https://api.github.com/users/AErmie/orgs","repos_url":"https://api.github.com/users/AErmie/repos","events_url":"https://api.github.com/users/AErmie/events{/privacy}","received_events_url":"https://api.github.com/users/AErmie/received_events","type":"User","site_admin":false},"created_at":"2018-11-14T13:38:46Z","updated_at":"2018-11-14T13:38:46Z","author_association":"NONE","body":"Yeah, my approach was wrong. The Azure Policy team helped me out with the correct method to audit the Resource Lock. \r\nThis Alias Request can be closed. "}}
{"actor":{"display_login":"AErmie"}}