aws-cdk-examples VS azure-policy

If you are in aws, look at CDK there are modules that make this pretty easy https://github.com/aws-samples/aws-cdk-examples/blob/master/typescript/lambda-cron/index.ts

I am not sure where to post my CDK question. I am trying this project specifically https://github.com/aws-samples/aws-cdk-examples/tree/master/python/existing-vpc-new-ec2-ebs-userdata

There are a ton of other example projects here for the AWS Cloud Development Kit: https://github.com/aws-samples/aws-cdk-examples Hope this helps, happy coding!

I am looking at examples of the CDK in python for example https://github.com/aws-samples/aws-cdk-examples/blob/master/python/ec2/instance/app.py

The cdk exple repo is also invaluable. I prefer cdk to terraform because it's actual infrastructure as Code as opposed to templating language as Code. There is fear of vendor lock. But I saw a while back that even hashicorp is working on a cdk implementation

For example, an AWS CDK that describes an infrastructure might look like this: https://github.com/aws-samples/aws-cdk-examples/tree/master/typescript/api-cors-lambda-crud-dynamodb

Reference: https://github.com/Azure/azure-policy

I just came across this post over in the Azure subreddit and it gave me a good idea on one way to deal with rogue Azure subscriptions - just have them default into a Management Group where a policy is in-place that basically denies use of any and all services.

Oooo, that's a nice trick for the use of the root management group which usually has best practice to leave empty. I like that a lot! Could maybe pair that with the "deny all resource types" policy sample, and then even if someone does create a new subscription it's pretty much 100% neutered until someone pulls it out of the root management group and places it somewhere else.

Found a 2018 Github article - https://github.com/Azure/azure-policy/issues/102

MS Repo https://github.com/Azure/azure-policy/tree/master/built-in-policies/policyDefinitions

I can see here that is expecting azure-policy/AzureWindowsBaseline.mof at master · Azure/azure-policy · GitHub: "LOCAL SERVICE, NETWORK SERVICE". However, that would exclude the web app pools.

Azure shared with us a GitHub repository contains built-in samples of Azure Policies that can be used as reference for creating and assigning policies to your subscriptions and resource groups.

The only real way you'll be able to do this is via an Azure Policy, alongside a deny effect - where your policy would restrict based on the type field, with the values passed in via an array parameter (example)