azure-policy icon indicating copy to clipboard operation
azure-policy copied to clipboard

Dependency agent should be enabled for listed virtual machine images - Scoping issue

Open TheodorWulff opened this issue 3 years ago • 1 comments

Details of the scenario you tried and the problem that is occurring

Hi,

We're trying to audit and deploy the Dependency Agent via the provided policies "Dependency agent should be enabled for listed virtual machine images" and "Deploy Dependency Agent for Linux VMs if the VM Image (OS) is in the list defined and the agent is not installed." (same for windows). The auditing policy is telling us that some images, which have not been added to the scope by providing the parameter "listOfImageIdToInclude_linux", don't have the Dependency Agent installed, while others that should be in scope per default don't even get evaluated. We suspect that the negation in line 49 might be the culprit and actually leads to an exclusion of the images following this block. This leads to some confusion since the policies that deploy the Dependency Agent, have roughly the same parameters but don't negate the condition.

Thanks in advance, we're Looking forward to hearing from you.

Suggested solution to the issue

Remove the "not" in line 49 of "Dependency agent should be enabled for listed virtual machine images".

Revise the default images to include in the evaluation scope.

TheodorWulff avatar Jun 08 '22 13:06 TheodorWulff

I'm running into the same issue at listOfImageIdToInclude_windows as it runs from the same 'not' at line 49

micknieman avatar Aug 04 '22 08:08 micknieman