Skip to content

Bug Report: Exclude Azure AI project because it doesn't have the property publicNetworkAccess #2070

@JamesDLD

Description

@JamesDLD

Describe the bug
The "Azure AI project" are resources of type "Microsoft.MachineLearningServices/workspaces" but do not support the option "Microsoft.MachineLearningServices/workspaces/publicNetworkAccess", it is the "Azure AI hub" from which they inherit that support this property.

The following policy "Azure Machine Learning should have disabled public network access - 438c38d2-3772-465a-a9cc-7a6666a275ce." should exclude "Azure AI project"
A solution could be to exclude "Azure AI project" from this policy through the following filter:

    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.MachineLearningServices/workspaces"
          },
          {
            "field": "Microsoft.MachineLearningServices/workspaces/kind",
            "notEquals": "Project"
          },
          {
            "anyOf": [
              {
                "field": "Microsoft.MachineLearningServices/workspaces/publicNetworkAccess",
                "exists": "false"
              },
              {
                "field": "Microsoft.MachineLearningServices/workspaces/publicNetworkAccess",
                "notEquals": "Disabled"
              }
            ]
          }
        ]
      },

Steps to reproduce

  1. Use the policy 438c38d2-3772-465a-a9cc-7a6666a275ce
  2. Create an Azure AI Hub with on Azure AI Project included

Screenshots

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions