I'm having trouble reading in a policy as a data block to remediate the policy.
The error is with the scope_id. I have used a azurerm_resouce_group.id, but it says "Policy Assignment Name: "Test-Inherit-RequiredTag-IheritedTag" was not found" I'm trying with the subscription Id , which it then said it expected "/subscriptions/" so I added that. Now it is "malformed or invalid."
I have also tried
scope_id = "/subscriptions/00000000-0000-0000-0000-00000000000/providers/microsoft.authorization/policyassignments/test-inherit-requiredtag-iheritedtag"
What is expected for the scope_id ?
data "azurerm_policy_assignment" "policy_assignment1" {
name = "Test-Inherit-RequiredTag-InheritedTag"
scope_id = "/subscriptions/${var.subscription_id}"
}
resource "azurerm_subscription_policy_remediation" "remediation1" {
name = "remediation1-inherit-tag"
subscription_id = var.subscription_id
policy_assignment_id = data.azurerm_policy_assignment.policy_assignment1.id
}
I tried to use azurerm_subscription_policy_remediation with my existing policy and I was successfully executed the
terrafrom_plan
&terraform_apply
commands.
I have referred the code from this official Terraform exemption document & [official Terraform remediation document] and modified it accordingly.
The module mentioned in the question.
data "azurerm_policy_assignment" "policy_assignment1" {
name = "Test-Inherit-RequiredTag-InheritedTag"
scope_id = "/subscriptions/${var.subscription_id}"
}
It was not worked for me as well, so I ended up modifying the modules as per the requirement and able to produce the output you're looking for.
My main.tf code:-
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "=3.59.0"
}
}
}
provider "azurerm" {
features {}
}
data "azurerm_subscription" "example" {}
data "azurerm_policy_set_definition" "example" {
display_name = "Audit machines with insecure password security settings"
}
resource "azurerm_subscription_policy_assignment" "example" {
name = "exampleAssignment"
subscription_id = data.azurerm_subscription.example.id
policy_definition_id = data.azurerm_policy_set_definition.example.id
location = "westus"
identity {
type = "SystemAssigned"
}
}
resource "azurerm_subscription_policy_remediation" "example" {
name = "example"
subscription_id = data.azurerm_subscription.example.id
policy_assignment_id = azurerm_subscription_policy_assignment.example.id
}
Output:
While executing terrafrom_plan
While executing terraform_apply
By using the script, I was successfully performed all terraform steps and the desired output.