azureazure-policyjsontemplate

Delete azure resource group after 30 days of creation based on tags using azure policy

How can I delete azure resource groups (having tag:delete-after-30-days) after 30 days of creation based on tags using azure policy. So far I came up with this -

    {
    "mode": "Indexed",
    "policyRule": {
        "if": {
            "allOf": [
                {
                    "field": "type",
                    "equals": "Microsoft.Resources/subscriptions/resourceGroups"
                },
                {
                    "not": {
                        "field": "[concat('tags[', parameters('tagName'), ']')]",
                        "exists": "false"
                    }
                },
                {
                    "field": "[concat('tags[', parameters('tagName'), ']')]",
                    "equals": "delete-after-30-days"
                },
                {
                    "field": "Microsoft.Resources/subscriptions/resourceGroups/createdTime",
                    "greaterThan": "[utcNow('-P30D')]"
                }
            ]
        },
        "then": {
            "effect": "deny"
        }
    },
    "parameters": {
        "tagName": {
            "type": "String",
            "metadata": {
                "displayName": "Tag Name",
                "description": "Name of the tag to identify resource groups for deletion"
            }
        }
    }
}

But Azure giving me an error -

Solution

  • To delete azure resource groups having tag: delete-after-30-days after 30 days of creation based on tags using azure policy:

    According to this MSDoc, Instead of using the utcnow( ) policy function, Use addDays(dateTime, DaysToAdd) function which will meet your requirements. It was used as follows:

    [addDays(utcNow(), -30)]

    The above function helps in policy implementation by calculating from the current date time to the 30 days after creation.

    I've created the below policy definition from Azure Portal and it was successfully created.

    I modified your code as below and added the below policy rule under policy rule code area while creating the policy definition.

    {
"mode": "Indexed",
"policyRule": {
  "if": {
   "allOf": [
    {
     "field": "type",
     "equals":"Microsoft.Resources/subscriptions/resourceGroups"
    },
    {
    "not": {
      "field": "[concat('tags[', parameters('tagName'),  ']')]",
      "exists": "false"
     }
  },
    {
    "field": "[concat('tags[', parameters('tagName'), ']')]",
    "equals": "delete-after-30-days"
   },
   {
    "field": "tags['delete-after-30-days']",
    "greater": "[addDays(utcNow(), -30)]"
   }
 ]
},
  "then": {
    "effect": "deny"
     }
  },
"parameters": {
   "tagName": {
    "type": "String",
    "metadata": {
      "displayName": "Tag Name",
      "description": "Name of the tag to identify resource groups for deletion"
            }
       }
   }
}

    Policy definition got created as shown:

    enter image description here

    enter image description here