Troubleshoot: deployments fail with RequestDisallowedByPolicy after a governance change
حل مشكلة: الـ Deployments بتفشل بـ RequestDisallowedByPolicy بعد تغيير في الحوكمة
Ticket #8120 (priority: high) — "Since Monday our pipeline cannot create the storage account stbillingprod01 in rg-ts-pol-prod : RequestDisallowedByPolicy . The developers also cannot create any scratch storage in their sandbox rg-ts-pol-sandbox . Please just delete the policy." The governance standard GOV-STO-7 says: production storage must use the storage firewall (default action Deny); the sandbox resource group is out of scope; the legacy account stlegacybill01 may stay open until the vendor migration, at most 30 days, and must be documented. Find the blocking assignment, fix each problem the right way (no deleting or disabling the policy), and prove the result in the compliance data.
The 4 tasks you will do
- Task 1 — Diagnose: find the assignment behind the errorالمهمة 1 — التشخيص: لاقي الـ Assignment اللي ورا الإيرور
- Task 2 — Fix production by deploying a compliant accountالمهمة 2 — صلّح الـ Production بإنك تنشر Account مطابق
- Task 3 — Take the sandbox out of scopeالمهمة 3 — طلّع الـ Sandbox برّه النطاق
- Task 4 — Document the legacy account and verify complianceالمهمة 4 — وثّق الحساب القديم واتأكد من الـ Compliance