Share via

Azure Policy to prevent AKS clusters diagnostic settings from using specific Storage Account

Raj Sandip Kaste 25 Reputation points
2025-08-06T22:33:06.26+00:00

Hi,
I am trying to implement an Azure Policy to prevent AKS clusters from sending diagnostic logs to a specific Storage Account (e.g., a disallowed storage account ID).

The goal is to:

  1. Deny new configurations of Microsoft.Insights/diagnosticSettings for AKS clusters when targeting that Storage Account.
  2. Audit existing diagnostic settings attached to AKS clusters that use this storage account.

The challenge is:

The scope or parent resource information is not available in policy aliases for Microsoft.Insights/diagnosticSettings. I cannot link the diagnostic setting back to the AKS resource (Microsoft.ContainerService/managedClusters) in the policy condition.
I’ve tried using auditIfNotExists, but the evaluation seems to run at the AKS resource level and doesn't help with child resource types.

Question:

Is there a recommended way to detect or deny diagnostic settings only when they are associated with AKS clusters and target a specific Storage Account? Any workaround (e.g., new aliases, nested conditions) to bridge this gap?

Thank you!

Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
0 comments
Accepted answer
  1. Michele Ariis 2,520 Reputation points MVP
    2025-08-07T08:21:17.34+00:00

    Hi, if you want to block or audit diagnostic settings on AKS clusters that send logs to disallowed storage accounts, the recommended method is to target the diagnostic setting resource directly, not the AKS cluster.

    Because diagnostic settings are extension resources nested under AKS (e.g., /managedClusters/<name>/providers/Microsoft.Insights/diagnosticSettings/<setting>), and Azure Policy can evaluate them only if your rule explicitly scopes to Microsoft.Insights/diagnosticSettings and uses contains(field('id'), '/managedClusters/') to catch only the ones tied to AKS.

    From there, you check the destination using the alias Microsoft.Insights/diagnosticSettings/storageAccountId. This lets you write a clean Deny policy that blocks settings pointing to specific storage accounts.

    You can also clone it with effect: Audit if you prefer to just monitor violations.

    Note: AuditIfNotExists doesn’t work well here, it evaluates at the AKS level and can’t “see” child diagnostic settings. That's why Microsoft recommends scoping the policy directly to the extension resource, which avoids alias limitations.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.