Setting up cloud custodian the first time.

[prabha11-sys]

I am new to cloud custodian and I am setting it up on azure cloudshell.

I tried testing cloud custodian with my first policy as mentioned in this document https://cloudcustodian.io/docs/azure/gettingstarted.html, however, the policy did not pick the VM specified in the filters and apply the tag

policies:
- name: my-first-policy
description: |
Adds a tag to a virtual machines
resource: azure.vm
filters:
- type: value
key: name
value: sandtestvm800
actions:
- type: tag
tag: Hello
value: World

I realized later that the I just had the Reader role on the subscription in which this VM is hosted. After I changed the role on the subscription, the policy completed and the tag was applied on the VM.

Doesn't cloud custodian specify the reason somewhere in the logs highlighting that I did not have the permission to apply the tag? the logs just had this info,

2024-03-12 06:13:42,458 - custodian.policy - INFO - policy:my-first-policy resource:azure.vm region:AzureCloud count:0 time:1.29
2024-03-12 06:14:31,860 - custodian.policy - INFO - policy:my-first-policy resource:azure.vm region:AzureCloud count:0 time:1.17