allow-resource-type
Type: regulative
Decision
A resource type must clear deny coverage, diagnostic settings, and job-function role review before it joins the allowed list.
Why
A type listed ahead of its controls is available to every landing zone with nothing enforcing how it is configured.
Violations
- Entry added to allowedResources.json before its deny policies were reviewed.
- Resource type listed with no diagnostic settings definition.
Anchor
no-unapproved-resources
Implements
Steps
- Read the rules this process is governed by.
- Add the resource type to allowedResources.json.
- Find the built-in diagnostic settings policy and add it to diagnosticSettings.bicepparam.
- For each file in oases/, find built-in policies with the required effect and add matching entries.
- For each gap where no built-in provides the required effect, author a custom definition and register it in policyDefinitions.bicepparam.
- Check defenderForCloudExemptions.jsonc for paid-SKU recommendations specific to this resource type.
- Check accessControl.bicepparam for custom role actions needed by this resource type.
- Present a complete draft of all changes before implementing.
Files
- platform-management/policy/parameters/oases/
- platform-management/policy/parameters/diagnosticSettings.bicepparam
- platform-management/policy/parameters/customDefinitions/
Links
← Back to knowledge graph