search

Azure / azure-policy

Repository for Azure Resource Policy built-in definitions and samples
MIT License
1.51k stars 1.09k forks source link

Add App Service FTPsState Aliases to be modifiable #938

Open YiHe2022 opened 2 years ago

YiHe2022 commented 2 years ago

Hi, is there any ways you can make these aliases to be modifiable aliases? (so we can use modify policy effect) Microsoft.Web/sites/config/ftpsState Microsoft.Web/sites/slot/config/ftpsState

We want our business users to be able to create azure app service that are enforcing ftpsonly setting by default.

Definition: { "parameters":{ }, "policyRule":{ "if":{ "allOf":[ { "field":"type", "equals":"Microsoft.Web/sites/config" }, { "field":"Microsoft.Web/sites/config/ftpsState", "equals":"AllAllowed" } ] }, "then":{ "effect":"modify", "details": { "conflictEffect": "audit", "operations": [ { "operation": "addOrReplace", "field": "Microsoft.Web/sites/config/ftpsState", "value": "FtpsOnly" } ], "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ] } } } }

ioeifcss commented 2 years ago

This would be really useful if it was a modifiable alias. Right now, we're having to use a mixture of DINE and modify which is far from ideal.

At the very least, if we can get an explanation of why it can't be made modifiable, that would be appreciated, because from an outsider's perspective, it seems quite erratic how some aliases are modifiable and others aren't!