Skip to content

Commit eddb7b3

Browse files
anosov1960anosov1960
authored
Merge pull request #1435 from anosov1960/PAYG-transition
Payg transition
2 parents c61d2a6 + 5da9b41 commit eddb7b3

15 files changed

Lines changed: 287 additions & 267 deletions

‎samples/manage/azure-arc-enabled-sql-server/compliance/README.md‎

Lines changed: 0 additions & 69 deletions
This file was deleted.

‎samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-payg-compliance/README.md‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# Paygo-SQLArc (Windows only)
2+
3+
This Azure Policy ensures that all SQL Arc servers using `LicenseType = Paid` are marked as non-compliant. Servers with `LicenseType = LicenseOnly` are treated as compliant. The remediation task sets `LicenseType = PAYG`.
4+
5+
Use Azure CLI or PowerShell to create the policy definition:
6+
7+
## Artifacts
8+
9+
- **policy.json**: Main policy definition referencing external parameter and rule files.
10+
- **params.json**: Defines policy parameters.
11+
- **rules.json**: Contains the policy rule logic.
12+
13+
## Copy policy artifacts to your environment
14+
15+
```PowerShell
16+
17+
curl https://raw.githubusercontent.com/microsoft/sql-server-samples/refs/heads/master/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-payg-compliance/params.json -o params.json
18+
curl https://raw.githubusercontent.com/microsoft/sql-server-samples/refs/heads/master/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-payg-compliance/rules.json -o rules.json
19+
20+
```
21+
22+
## Create policy
23+
24+
Use the following command to create policy
25+
26+
```PowerShell
27+
28+
$SubId = "<your-subscription-id>"
29+
$PolicyName = "Paygo-SQLArc"
30+
31+
az policy definition create `
32+
--name $PolicyName `
33+
--display-name $PolicyName `
34+
--description "This Azure Policy ensures that all SQL Arc servers using LicenseType = Paid are marked as non-compliant. Servers with LicenseType = LicenseOnly are treated as compliant. The remediation task sets LicenseType = PAYG." `
35+
--rules "@rules.json" `
36+
--params "@params.json" `
37+
--mode Indexed `
38+
--subscription $SubId `
39+
--only-show-errors | Out-Null
40+
```
41+
42+
## Assign policy
43+
44+
Use the following command to assign policy
45+
46+
```PowerShell
47+
48+
$SubId = "<your-subscription-id>"
49+
$RgName = "<your-resource-group>" # optional; set to "" to target subscription scope
50+
$Location = "<your-azure-region>" # e.g., eastus, westus2
51+
52+
if ([string]::IsNullOrWhiteSpace($RgName)) {
53+
$Scope = "/subscriptions/$SubId"
54+
} else {
55+
$Scope = "/subscriptions/$SubId/resourceGroups/$RgName"
56+
}
57+
58+
az account set --subscription $SubId
59+
60+
az policy assignment create `
61+
--name "Paygo-SQLArc-Assign" `
62+
--policy "Paygo-SQLArc" `
63+
--scope "$Scope" `
64+
--params '{ "effect": { "value": "DeployIfNotExists" } }' `
65+
--mi-system-assigned `
66+
--role "Contributor" `
67+
--identity-scope "$Scope" `
68+
--location "$Location" `
69+
--only-show-errors | Out-Null
70+
```
71+
72+
## Create remediation task
73+
74+
Use the following command to create a remediation task
75+
76+
```PowerShell
77+
78+
$RemediationName = "Remediate-Paygo-SQLArc"
79+
$PolicyAssignmentName = "Paygo-SQLArc-Assign"
80+
$SubId = "<your-subscription-id>"
81+
$RgName = "<your-resource-group>"
82+
83+
az account set --subscription $SubId
84+
85+
if ([string]::IsNullOrWhiteSpace($RgName)) {
86+
az policy remediation create `
87+
--name $RemediationName `
88+
--policy-assignment $PolicyAssignmentName `
89+
--resource-discovery-mode ReEvaluateCompliance `
90+
--only-show-errors | Out-Null
91+
} else {
92+
az policy remediation create `
93+
--name $RemediationName `
94+
--policy-assignment $PolicyAssignmentName `
95+
--resource-group "$RgName" `
96+
--resource-discovery-mode ReEvaluateCompliance `
97+
--only-show-errors | Out-Null
98+
}
99+
```
100+
101+
## Remove remediation task
102+
103+
```PowerShell
104+
105+
$RemediationName = "Remediate-Paygo-SQLArc"
106+
$RgName = "<your-resource-group>"
107+
$SubId = "<your-subscription-id>"
108+
109+
if ([string]::IsNullOrWhiteSpace($RgName)) {
110+
az policy remediation cancel `
111+
--name $RemediationName `
112+
--subscription $SubId `
113+
--only-show-errors | Out-Null
114+
az policy remediation delete `
115+
--name $RemediationName `
116+
--subscription $SubId `
117+
--only-show-errors | Out-Null
118+
} else {
119+
az policy remediation cancel `
120+
--name $RemediationName `
121+
--resource-group $RgName `
122+
--subscription $SubId `
123+
--only-show-errors | Out-Null
124+
az policy remediation delete `
125+
--name $RemediationName `
126+
--resource-group $RgName `
127+
--subscription $SubId `
128+
--only-show-errors | Out-Null
129+
}
130+
```

‎samples/manage/azure-hybrid-benefit/compliance/azure-sql-payg-compliance/sql-mi-payg-compliance/README.md‎

Lines changed: 102 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -10,60 +10,121 @@ Use Azure CLI or PowerShell to create the policy definition:
1010
- **params.json**: Defines policy parameters.
1111
- **rules.json**: Contains the policy rule logic.
1212

13+
## Copy policy artifacts to your environment
14+
15+
```PowerShell
16+
17+
curl https://raw.githubusercontent.com/microsoft/sql-server-samples/refs/heads/master/samples/manage/azure-hybrid-benefit/compliance/azure-sql-payg-compliance/sql-mi-payg-compliance/params.json -o params.json
18+
curl https://raw.githubusercontent.com/microsoft/sql-server-samples/refs/heads/master/samples/manage/azure-hybrid-benefit/compliance/azure-sql-payg-compliance/sql-mi-payg-compliance/rules.json -o rules.json
19+
20+
```
21+
1322
## Create policy
23+
1424
Use the following command to create policy
1525

16-
```bash
26+
```PowerShell
1727
18-
#!/bin/bash
28+
$SubId = "<your-subscription-id>"
29+
$PolicyName = "Paygo-SQLMI"
1930
20-
az policy definition create \
21-
--name "Paygo-SQLArc" \
22-
--display-name "Paygo-SQLMI" \
23-
--description "This Azure Policy ensures that all SQL Managed Instance resources using LicenseType = BasePrice are marked as non-compliant. The remediation task sets LicenseType = LicenseIncluded." \
24-
--rules @rules.json \
25-
--params @params.json \
26-
--mode Indexed \
27-
--subscription "<your-subscription-id>"\
31+
az policy definition create `
32+
--name $PolicyName `
33+
--display-name $PolicyName `
34+
--description "This Azure Policy ensures that all SQL Managed Instance resources using LicenseType = BasePrice are marked as non-compliant. The remediation task sets LicenseType = LicenseIncluded" `
35+
--rules "@rules.json" `
36+
--params "@params.json" `
37+
--mode Indexed `
38+
--subscription $SubId `
39+
--only-show-errors | Out-Null
2840
```
2941

3042
## Assign policy
3143

3244
Use the following command to assign policy
3345

34-
```bash
35-
#!/bin/bash
36-
37-
# Set variables
38-
SUB_ID="<your-subscription-id>"
39-
RG_NAME="<your-resoure-group>" # optional
40-
SCOPE="/subscriptions/$SUB_ID/resourceGroups/$RG_NAME"
41-
LOCATION="<your-azure-region>"
42-
43-
# Create policy assignment
44-
az policy assignment create \
45-
--name "Paygo-SQLMI-Assign" \
46-
--policy "Paygo-SQLArc" \
47-
--scope "$SCOPE" \
48-
--params '{ "effect": { "value": "DeployIfNotExists" } }' \
49-
--mi-system-assigned \
50-
--role "Contributor" \
51-
--identity-scope "$SCOPE" \
52-
--location "$LOCATION"
46+
```PowerShell
47+
48+
$SubId = "<your-subscription-id>"
49+
$RgName = "<your-resource-group>" # optional; set to "" to target subscription scope
50+
$Location = "<your-azure-region>" # e.g., eastus, westus2
51+
52+
if ([string]::IsNullOrWhiteSpace($RgName)) {
53+
$Scope = "/subscriptions/$SubId"
54+
} else {
55+
$Scope = "/subscriptions/$SubId/resourceGroups/$RgName"
56+
}
57+
58+
az account set --subscription $SubId
59+
60+
az policy assignment create `
61+
--name "Paygo-SQLMI-Assign" `
62+
--policy "Paygo-SQLMI" `
63+
--scope "$Scope" `
64+
--params '{ "effect": { "value": "DeployIfNotExists" } }' `
65+
--mi-system-assigned `
66+
--role "Contributor" `
67+
--identity-scope "$Scope" `
68+
--location "$Location" `
69+
--only-show-errors | Out-Null
5370
```
5471

5572
## Create remediation task
5673

57-
Us the following command to create a remediation task
58-
59-
```bash
60-
#!/bin/bash
61-
62-
RG_NAME="<your-resoure-group>"
63-
64-
az policy remediation create \
65-
--name "Remediate-Paygo-SQLMI" \
66-
--policy-assignment "Paygo-SQLMI-Assign" \
67-
--resource-group "$RG_NAME" \
68-
--resource-discovery-mode ReEvaluateCompliance
74+
Use the following command to create a remediation task
75+
76+
```PowerShell
77+
78+
$RemediationName = "Remediate-Paygo-SQLMI"
79+
$PolicyAssignmentName = "Paygo-SQLMI-Assign"
80+
$SubId = "<your-subscription-id>"
81+
$RgName = "<your-resource-group>"
82+
83+
az account set --subscription $SubId
84+
85+
if ([string]::IsNullOrWhiteSpace($RgName)) {
86+
az policy remediation create `
87+
--name $RemediationName `
88+
--policy-assignment $PolicyAssignmentName `
89+
--resource-discovery-mode ReEvaluateCompliance `
90+
--only-show-errors | Out-Null
91+
} else {
92+
az policy remediation create `
93+
--name $RemediationName `
94+
--policy-assignment $PolicyAssignmentName `
95+
--resource-group "$RgName" `
96+
--resource-discovery-mode ReEvaluateCompliance `
97+
--only-show-errors | Out-Null
98+
}
6999
```
100+
101+
## Remove remediation task
102+
103+
```PowerShell
104+
105+
$RemediationName = "Remediate-Paygo-SQLMI"
106+
$RgName = "<your-resource-group>"
107+
$SubId = "<your-subscription-id>"
108+
109+
if ([string]::IsNullOrWhiteSpace($RgName)) {
110+
az policy remediation cancel `
111+
--name $RemediationName `
112+
--subscription $SubId `
113+
--only-show-errors | Out-Null
114+
az policy remediation delete `
115+
--name $RemediationName `
116+
--subscription $SubId `
117+
--only-show-errors | Out-Null
118+
} else {
119+
az policy remediation cancel `
120+
--name $RemediationName `
121+
--resource-group $RgName `
122+
--subscription $SubId `
123+
--only-show-errors | Out-Null
124+
az policy remediation delete `
125+
--name $RemediationName `
126+
--resource-group $RgName `
127+
--subscription $SubId `
128+
--only-show-errors | Out-Null
129+
}
130+
```

‎samples/manage/azure-hybrid-benefit/compliance/azure-sql-payg-compliance/sql-mi-payg-compliance/params.json‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
11
{
2-
"parameters": {
3-
"effect": {
4-
"type": "String",
5-
"metadata": {
6-
"displayName": "Effect",
7-
"description": "Use DeployIfNotExists to remediate; use Disabled to turn off."
8-
},
9-
"allowedValues": [
10-
"DeployIfNotExists",
11-
"Disabled"
12-
],
13-
"defaultValue": "DeployIfNotExists"
14-
}
2+
"effect": {
3+
"type": "String",
4+
"metadata": {
5+
"displayName": "Effect",
6+
"description": "Enable or disable the execution of the policy."
7+
},
8+
"allowedValues": [
9+
"DeployIfNotExists",
10+
"Disabled"
11+
],
12+
"defaultValue": "DeployIfNotExists"
1513
}
1614
}

0 commit comments

Comments
 (0)