|
Policy Rule
|
{
"properties": {
"displayName": "Cognitive Services accounts should enable data encryption",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "This policy audits any Cognitive Services account not using data encryption. For each Cognitive Services account with storage, should enable data encryption with either customer managed or Microsoft managed key.",
"metadata": {
"version": "1.0.0",
"category": "Cognitive Services"
},
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "The effect determines what happens when the policy rule is evaluated to match"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Audit"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.CognitiveServices/accounts"
},
{
"field": "Microsoft.CognitiveServices/accounts/encryption.keySource",
"exists": "false"
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/2bdd0062-9d75-436e-89df-487dd8e4b3c7",
"type": "Microsoft.Authorization/policyDefinitions",
"name": "2bdd0062-9d75-436e-89df-487dd8e4b3c7"
}
|