AzPolicyAdvertizer

last sync: 2025-Nov-03 18:22:57 UTC

Ensure ephemeral disks are used for OS disks on Agent Pool Profiles

Community Policy definition

Source

Repository Community-Policy GitHub
JSON Community-Policy GitHub

Deploy policy 2dec5f47-bc40-40d1-8c7d-a39d9d6808d2 (1.0.0) to Azure

Display name

Ensure ephemeral disks are used for OS disks on Agent Pool Profiles

2dec5f47-bc40-40d1-8c7d-a39d9d6808d2

Version

1.0.0
Details on versioning

Category

Kubernetes
Microsoft Learn

Description

Ephemeral OS disks are created on the local virtual machine (VM) storage and not saved to the remote Azure Storage, as when using managed OS disks.

Mode

All

Type

Custom Community

Effect

Default
Audit
Allowed
Deny, Audit, Disabled

RBAC role(s)

none

Rule aliases

IF (1)

Alias	Namespace	ResourceType	Path	PathIsDefault	DefaultPath	Modifiable
Microsoft.ContainerService/managedClusters/agentPoolProfiles[*].osDiskType	Microsoft.ContainerService	managedClusters	properties.agentPoolProfiles[*].osDiskType	True		False

Rule resource types

IF (1)
Microsoft.ContainerService/managedClusters

JSON

EPAC

{6 itemsdisplayName: "Ensure ephemeral disks are used for OS disks on Agent Pool Profiles",
description: "Ephemeral OS disks are created on the local virtual machine (VM) storage and not saved to the remote Azure Storage, as when using managed OS disks.",
metadata: {2 itemsversion: "1.0.0",
category: "Kubernetes"
},
mode: "All",
parameters: {1 itemeffect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Deny, Audit or Disabled the execution of the Policy"
},
allowedValues: [3 items"Deny",
"Audit",
"Disabled"
],
defaultValue: "Audit"
}
},
policyRule: {2 itemsif: {1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.ContainerService/managedClusters"
},
{2 itemsfield: "Microsoft.ContainerService/managedClusters/agentPoolProfiles[*].osDiskType",
notequals: "Ephemeral"
}
]
},
then: {1 itemeffect: "[parameters('effect')]"
}
}
}