Step 4: Governance Constraints - PCI DSS Gateway

🔒 Step 4: Governance Constraints - PCI DSS Gateway

• 🔍 Discovery Source
• 📋 Azure Policy Compliance
• 🔄 Plan Adaptations Based on Policies
• 🚫 Deployment Blockers
• 🏷️ Required Tags
• 🔐 Security Policies
• 💰 Cost Policies
• 🌐 Network Policies

Generated by @bicep-plan agent | 2026-02-11

[!NOTE] 📚 See SKILL.md for visual standards.

This document captures the governance constraints and Azure Policy requirements that must be addressed in the Bicep implementation for the PCI-DSS Level 1 payment gateway.

🔍 Discovery Source

[!IMPORTANT] Governance constraints discovered via REST API including management group-inherited policies. Previous az policy assignment list discovery missed 16 of 21 policies.

Discovery Method: REST API (GET /subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments?api-version=2022-06-01)

Subscription: noalz (00858ffc-dded-4f0f-8bbf-e17fff0d47d9)

Tenant: 2d04cb4c-999b-4e60-a3a7-e8993edc768b

Scope: All effective (subscription + resource group + management group inherited)

[!CAUTION] Previous discovery using az policy assignment list only returned 5 subscription-scoped policies. REST API revealed 16 additional policies including critical Deny blockers.

📋 Azure Policy Compliance

Complete Policy Inventory

Management Group-Inherited Policies (9)

Subscription-Scoped Policies (5)

Resource Group-Scoped Policies (7)

All scoped to rg-arcbox-swc01 — a different resource group. No impact on this project.

🔄 Plan Adaptations Based on Policies

Tag Schema (Updated — CRITICAL)

// Resource Group tags — ALL 9 REQUIRED by JV-Enforce Resource Group Tags v3 (Deny)
// Case-sensitive: ALL lowercase
@description('Deployment environment')
@allowed(['dev', 'staging', 'prod'])
param environment string

@description('Team or individual owner')
param owner string

@description('Cost center code')
param costCenter string

@description('Technical contact email')
param technicalContact string

var requiredRgTags = {
  environment: environment
  owner: owner
  costcenter: costCenter
  application: 'pci-dss-gw'
  workload: 'payment-gateway'
  sla: '99.99'
  'backup-policy': 'daily'
  'maint-window': 'Sun:02:00-06:00'
  'technical-contact': technicalContact
}

// Additional project-standard tags (not policy-enforced but recommended)
var allTags = union(requiredRgTags, {
  ManagedBy: 'Bicep'
  Project: 'pci-dss-gw'
})

[!IMPORTANT] Resource groups require ALL 9 tags from JV-Enforce Resource Group Tags v3. Child resources auto-inherit these 9 tags via JV - Inherit Multiple Tags from Resource Group (Modify effect). Additional tags (ManagedBy, Project) can be appended but are NOT required.

Architectural Constraints

Auto-Applied Configurations

🚫 Deployment Blockers

[!CAUTION] CRITICAL: Policies that BLOCK deployment. Resolution is REQUIRED before proceeding.

Blocker 1: JV-Enforce Resource Group Tags v3 (DENY)

Assignment: b1ad1a690a5148ec8707ff17

Scope: Management Group (Tenant Root 2d04cb4c-999b-4e60-a3a7-e8993edc768b)

Enforcement Mode: Default (enabled)

Effect: Deny

Policy Definition: 27833bcf-5909-4a37-891c-16a3cb06856d

Policy Rule:

• Applies to: Microsoft.Resources/subscriptions/resourceGroups
• Excludes RG names matching: AzureBackupRG*, ResourceMover*, databricks-rg*, NetworkWatcherRG, microsoft-network, LogAnalyticsDefaultResources, rg-amba-*, DynamicsDeployments*, MC_myResourceGroup*
• Denies creation if ANY of 9 tags are missing (case-sensitive, all lowercase)

[!WARNING] Our original plan only had 4 tags (Environment, ManagedBy, Project, Owner) with PascalCase. This policy requires 9 tags with lowercase names. Resource group creation will be DENIED without all 9 tags present.

Resolution: Update all Bicep resource group deployments to include all 9 required tags with correct lowercase casing. The ManagedBy and Project tags from our defaults are supplementary but NOT required by policy.

Blocker 2: MCAPSGov Deny Policies (11 sub-policies)

Assignment: MCAPSGovDenyPolicies

Scope: Management Group (Tenant Root 2d04cb4c-999b-4e60-a3a7-e8993edc768b)

Enforcement Mode: Default (enabled)

Effect: Deny (initiative with 11 policies)

Resolutions:

1. AKS agent pool limit: Architecture uses 2 pools — compliant. Document constraint.
2. VMSS node count: Verify the exact limit parameter and ensure AKS autoscaler max does not exceed it.
3. Key Vault HSM purge protection: Set enablePurgeProtection: true on Key Vault.
4. VM SKUs: Only D-series VMs used — compliant. Document blocked families.

Non-Blocker: Block Azure RM Resource Creation (DENY)

Scope: Management Group (Tenant Root)

Assessment: This policy ONLY blocks Classic (ASM) resource types: Microsoft.ClassicCompute/*, Microsoft.ClassicStorage/*, Microsoft.ClassicNetwork/*.

Impact: None — our Bicep templates use ARM resources exclusively.

🏷️ Required Tags

Resource Group Tags (MANDATORY — Deny enforced)

// These 9 tags are REQUIRED by JV-Enforce Resource Group Tags v3 (Deny)
// ALL lowercase, case-sensitive — deployment will FAIL without them
var requiredRgTags = {
  environment: environment          // 'dev' | 'staging' | 'prod'
  owner: owner                      // Team or individual
  costcenter: costCenter            // Cost center code
  application: 'pci-dss-gw'          // Application name
  workload: 'payment-gateway'      // Workload type
  sla: '99.99'                     // SLA target
  'backup-policy': 'daily'         // Backup policy
  'maint-window': 'Sun:02:00-06:00' // Maintenance window
  'technical-contact': techContact  // Technical contact email
}

Resource Tags (Project standard + auto-inherited)

// Child resources auto-inherit 9 RG tags via JV-Inherit policy (Modify)
// These additional tags are project convention, not policy-enforced
var additionalTags = {
  ManagedBy: 'Bicep'
  Project: 'pci-dss-gw'
}

var allTags = union(requiredRgTags, additionalTags)

🔐 Security Policies

💰 Cost Policies

🌐 Network Policies

[!NOTE] No network-specific Deny policies found. Architecture follows PCI-DSS network segmentation requirements proactively (hub-spoke, private endpoints, Azure Firewall IDPS).

Generated by Azure Agentic InfraOps | GitHub

References

Governance constraints discovered via REST API on subscription noalz (00858ffc-dded-4f0f-8bbf-e17fff0d47d9). All 21 assignments verified including 9 management group-inherited policies. See governance-discovery.instructions.md for discovery methodology.