Managing Azure Policies as Code with Terraform

Last Updated on November 14, 2024 by Arnav Sharma

Infrastructure as Code (IaC) is transforming how organizations manage resources in cloud environments, enabling version control, automation, and policy enforcement. Maintaining compliance with organisational, legal, and security requirements depends on enterprises using Microsoft Azure following governance rules defined by Azure Policies, which impose themselves across resources.

Teams can easily include governance into their infrastructure design by controlling Azure Policies as code with Terraform, therefore improving security and compliance and streamlining enforcement. From building your Terraform project to best practices for policy administration, this article will walk you through how to develop, implement, and maintain Azure Policies as code using Terraform.

What are Azure Policies?

A governance tool available in Microsoft Azure, Azure Policies guarantees resources follow particular criteria and best practices. Policies assist companies avoid drift and keep safe configurations by preventing activities (such distributing non-compliant resources) or tracking compliance. Typical applications consist in:

• Location Restrictions: Limiting where resources can be deployed.
• Enforcing Tags: Ensuring resources have required tags, aiding in cost tracking and resource identification.
• Resource Types: Restricting which resource types can be created, like allowing only specific VM sizes.
• Security Standards: Ensuring specific configurations, like enforcing HTTPS on web applications.

Azure Policies support a variety of effects that dictate what happens when non-compliant resources are detected. Common effects include:

• Deny: Prevents the creation of resources that don’t comply with the policy.
• Audit: Flags non-compliant resources without blocking their creation.
• Append: Adds missing properties to a resource configuration.
• Modify: Changes resource properties during creation to make them compliant.

Why Manage Azure Policies as Code with Terraform?

Using Terraform to manage Azure Policies allows organizations to define, track, and enforce policies in a structured, programmatic way. Key benefits include:

• Version Control: Version control systems such as Git store policies stated as code, enabling historical tracking of changes and rollback should needed.
• Automation: Policies provide consistency and reduce human error by allowing their implementation and management across environments (development, staging, manufacturing) free from manual participation.
• Auditability: Terraform’s declarative syntax makes it easy to review policies and see exactly what is being enforced in the environment.
• Consistency Across Environments: When managing policies as code, you can be certain the same policies are applied consistently across all your environments.

Prerequisites

To follow along with this tutorial, you’ll need:

1. Terraform installed on your machine.
2. Azure CLI to authenticate and interact with your Azure account.
3. Contributor Access to the Azure subscription or resource group where you’ll apply policies.

Step-by-Step Guide to Managing Azure Policies with Terraform

Set Up Your Terraform Project

Start by creating a directory for your Terraform configuration files, where you’ll define your Azure provider, policy definitions, and assignments.

mkdir azure-policy-management

cd azure-policy-management

terraform init

The terraform init command initializes the directory, preparing it to download any required providers and plugins, which is essential for connecting to Azure.

Configure the Azure Provider in Terraform

Your Terraform configuration must specify the Azure provider, which enables Terraform to connect to Azure and manage resources.

provider "azurerm" {
  features {}
}

The features {} block is required but can be left empty for most basic configurations. You might want to specify a particular subscription if you’re working in a multi-subscription environment.

Define an Azure Policy Using JSON

Azure Policies are typically defined in JSON format, which includes the policy details like the rule and enforcement effect. Create a new file, allowed_locations_policy.json, that restricts deployments to specific regions:

{
"properties": {
    "displayName": "Allowed locations",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {
      "listOfAllowedLocations": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed locations",
          "description": "List of allowed regions for resource deployment."
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "location",
        "notIn": "[parameters('listOfAllowedLocations')]"
      },
      "then": {
        "effect": "Deny"
      }
    }
  }
}

This policy denies resource deployment to regions not included in listOfAllowedLocations. You can modify the allowed regions based on organizational needs.

Define the Policy in Terraform

In main.tf, use the azurerm_policy_definition resource to refer to the JSON policy file. This approach allows Terraform to manage the policy definition as a resource.

resource "azurerm_policy_definition" "allowed_locations" {
  name = "allowed-locations-policy"
  policy_type = "Custom"
  mode = "All"
  display_name = "Allowed Locations"
  policy_rule = file("${path.module}/allowed_locations_policy.json")
  parameters = jsonencode({
    listOfAllowedLocations = {
      type = "Array"
      defaultValue = ["East US", "West Europe"]
      metadata = {
        displayName = "Allowed locations"
        description = "Regions allowed for resource deployment."
      }
    }
  })
}

This configuration pulls in the policy definition JSON and defines defaultValue for allowed regions. You can adjust the defaultValue to include specific regions based on your organization’s needs.

Assign the Policy to a Scope

To apply the policy, define an azurerm_policy_assignment resource. This resource allows you to assign the policy to a specific scope (subscription, resource group, etc.).

resource "azurerm_policy_assignment" "assign_allowed_locations" {
  name = "assign-allowed-locations-policy"
  policy_definition_id = azurerm_policy_definition.allowed_locations.id
  scope = "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>"
  parameters = jsonencode({
    listOfAllowedLocations = {
      value = ["East US", "West Europe"]
    }
  })
}

Replace <SUBSCRIPTION_ID> and <RESOURCE_GROUP_NAME> with your actual Azure subscription ID and resource group name.

Apply the Terraform Configuration

To apply the configuration, use the following Terraform commands:

terraform plan
terraform apply

terraform plan previews the changes, and terraform apply implements them. Confirm the application by typing yeswhen prompted.

Advanced Tips and Best Practices

Modularize Policies

Modularizing policies by creating Terraform modules allows for reusable code and easier management across environments.

Use Version Control

Store all Terraform configurations in a version-controlled repository like Git. This enables tracking of changes, easier auditing, and rolling back to previous versions if needed.

Separate Policy Definitions and Assignments

Separate policy definitions from assignments, allowing for flexible policy application across different scopes without redefining the entire policy.

Regularly Monitor Compliance

Review Azure Policy compliance data on the Azure portal frequently after deployment to ensure policies are properly installed and resources remain compliant.

Test Policies in Non-Production Environments

Always test policies in development or staging before putting them into production. This allows you to identify configuration issues without impacting production workloads.

Conclusion

Using Terraform to manage Azure Policies as code offers a scalable, consistent, automated method of cloud governance. Defining policies as code helps teams improve their cloud security posture, implement governance across several environments, and simplify policy execution.

Integrating policy management with Terraform supports DevOps practices and improves compliance, ensuring that infrastructure aligns with organizational standards. With this approach, you’ll be well-prepared to manage cloud resources in a secure, efficient, and compliant manner.