diff --git a/auto_policy_testing/green/spring/spring_cloud.tf b/auto_policy_testing/green/spring/spring_cloud.tf
index 48e0d1ec..97b62973 100644
--- a/auto_policy_testing/green/spring/spring_cloud.tf
+++ b/auto_policy_testing/green/spring/spring_cloud.tf
@@ -23,6 +23,14 @@ resource "azurerm_subnet" "app_subnet" {
   address_prefixes     = ["10.1.1.0/24"]
 }
 
+resource "azurerm_role_assignment" "this" {
+  scope                = azurerm_virtual_network.this.id
+  role_definition_name = "Owner"
+  principal_id         = "e8de9221-a19c-4c81-b814-fd37c6caf9d2"
+
+  depends_on = [ azurerm_subnet.app_subnet ]
+}
+
 resource "azurerm_application_insights" "this" {
   name                = module.naming.resource_prefix.appinsights
   location            = data.terraform_remote_state.common.outputs.location
@@ -45,4 +53,6 @@ resource "azurerm_spring_cloud_service" "this" {
   }
 
   tags = module.naming.default_tags
+
+  depends_on = [ azurerm_role_assignment.this ]
 }
\ No newline at end of file
diff --git a/auto_policy_testing/red/vnet/application_gateway.tf b/auto_policy_testing/red/vnet/application_gateway.tf
index 261d4b60..9abce432 100644
--- a/auto_policy_testing/red/vnet/application_gateway.tf
+++ b/auto_policy_testing/red/vnet/application_gateway.tf
@@ -94,11 +94,4 @@ resource "azurerm_application_gateway" "this" {
   }
 
   tags = module.naming.default_tags
-}
-
-resource "azurerm_network_ddos_protection_plan" "this" {
-  name                = "autotestci_vnet-ddos_prot_plan1"
-  location            = "eastus"
-  resource_group_name = azurerm_resource_group.this.name
-  tags                = module.naming.default_tags
 }
\ No newline at end of file