search

Azure / azure-policy

Repository for Azure Resource Policy built-in definitions and samples
MIT License
1.49k stars 1.08k forks source link

Built-in policy "Configure a private DNS Zone ID for web groupID" wrongly applies to Azure Synapse Private Link Hubs private endpoints #1155

Open juanandmsft opened 1 year ago

juanandmsft commented 1 year ago

Details of the scenario you tried and the problem that is occurring

The built-in policy "Configure a private DNS Zone ID for web groupID" (9adab2a5-05ba-4fbd-831a-5bf958d04218) only filters on "groupId", but does not filter on "privateLinkServiceId" as other policies, such as "Configure Azure Synapse workspaces to use private DNS zones" (1e5ed725-f16c-478b-bd4b-7bfa2f7940b9).

Because Azure Synapse Private Link Hubs also use "web" groupId, the assignment of the web storage policy to a scope with an Azure Synapse Private Link Hub private endpoint causes it to be registered in the "privatelink.web.core.windows.net" zone, rather than in "privatelink.azuresynapse.net" zone.

image

Verbose logs showing the problem

Suggested solution to the issue

Modify the built-in policy for Azure Storage "web" groupId to also filter by "privateLinkServiceId", and not only by "groupId".

If policy is Guest Configuration - details about target node

ri-we commented 10 months ago

I'm running into this issue, is there an ETA for a fix? Or should I create a custom policy as a workaround?