Cloud Custodian: Find all VMs without tags Azure

Question

How to find all VMs in my Azure Subscription without any tags?

I tried below policy, but it doesn't seems to work:

policies:
   - name: az-vm-tag-complience
     resource: azure.vm
     filters:
       tag: none




 

Answer 1

This is not perfect but close:

policies:
  - name: find-vms-without-any-tags
    resource: azure.vm
    filters:
      - type: value
        key: "tags"
        value: absent

It will also filter out VMs that probably once had tags but they were removed so the tags container element is empty but present.