Assign Policy parameters to builtin policies in an initiative

[AnshuBhatiaGit]

Is there an example how you can assign initiative parameters values to a custom initiative? I am having a hard time building a custom initiative with builit-in policies and assign initiative parameters value to each policy in that custom initiative.

** I am just referring the built-in policy names to create the initiative and don't have json files.**

I am able to create custom initiative with built-in policies but cannot assign the initative parameters values for built-in policies

Below is my code

data azurerm_policy_definition deploy_laws {
  display_name = "Configure diagnostic settings for Blob Services to Log Analytics workspace"
}

data "azurerm_role_definition" "laws_contributor" {
    name = "Resource Policy Contributor"
}

module configure_asc_initiative {
  source                  = "../../modules/initiative"
  initiative_name         = "configure_asc_initiative"
  initiative_display_name = "[TF]: Deploy Laws"
  initiative_description  = "Deploys and configures Azure laws"
  initiative_category     = "Security Center"
  management_group_id     = var.mgmt_group_name
 
  # Dynamically generate member_definitions using policy data
    # member_definitions = [
    #    data.azurerm_policy_definition.deploy_laws,
    # ]
# Setting initiative parameters within member_definitions
  member_definitions = [
    {
      id         = data.azurerm_policy_definition.deploy_laws.id
      name       = data.azurerm_policy_definition.deploy_laws.display_name
      parameters = jsonencode({
        logAnalytics = { value = local.dummy_resource_ids.azurerm_log_analytics_workspace }
        metricsEnabled = { value = true }
        logsEnabled = { value = true }
      })
    }
  ]
}

# get all the generated parameter names so we know what to use during assignment
output "list_of_initiative_parameters" {
  value = keys(module.configure_asc_initiative.parameters)
}

output "initiative" {
  value = module.configure_asc_initiative.initiative
}

The code gives me error

Error: creating Scoped Policy Assignment (Scope: "/providers/Microsoft.Management/managementGroups/Lab"
│ Policy Assignment Name: "configure_asc_initiative"): unexpected status 400 (400 Bad Request) with error: PolicySetDefinitionNotFound: The policy assignment create request is invalid. The policy set definition '/providers/Microsoft.Management/managementGroups/Lab/providers/Microsoft.Authorization/policySetDefinitions/configure_asc_initiative' could not be found.
│ 
│   with module.org_mg_configure_az_monitor_linux_vm_initiative.azurerm_management_group_policy_assignment.set[0],
│   on ../../modules/set_assignment/main.tf line 5, in resource "azurerm_management_group_policy_assignment" "set":
│    5: resource "azurerm_management_group_policy_assignment" "set" {
│ 
│ creating Scoped Policy Assignment (Scope: "/providers/Microsoft.Management/managementGroups/Lab"
│ Policy Assignment Name: "configure_asc_initiative"): unexpected status 400 (400 Bad Request) with error: PolicySetDefinitionNotFound: The policy assignment
│ create request is invalid. The policy set definition
│ '/providers/Microsoft.Management/managementGroups/Lab/providers/Microsoft.Authorization/policySetDefinitions/configure_asc_initiative' could not be found.
╵

I would greatly appreciate if you can give me an example of setting initiative parameters, that would help me move forward.
I looked into the examples folder and could not find there.

What am I doing wrong?

[gettek]

An example can be found in the initiative module readme

[AnshuBhatiaGit]

Hi @gettek ,
Thanks for the quick reply.
I did follow the same example but this issue I am facing is setting the initiative parameters. Is there a way u can guide me in the right direction.
This code gives me error even though I am setting the var.loganalytics value in variables.tf file and the error it gives is

Error: creating Policy Set Definition "b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb": policy.SetDefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="MissingPolicyParameter" Message="The policy set definition 'b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb' is missing the parameter(s) 'logAnalytics' as defined in the policy definition 'b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb'."
│ 
│   with module.configure_asc_initiative.azurerm_policy_set_definition.set,
│   on ../../modules/initiative/main.tf line 7, in resource "azurerm_policy_set_definition" "set":
│    7: resource "azurerm_policy_set_definition" "set" {

data azurerm_policy_definition deploy_laws {
 name = "b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb"
}

data "azurerm_role_definition" "laws_contributor" {
    name = "Resource Policy Contributor"
}

locals {
  parameters = [
    {
     // policy_definition_id = "b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb"
      policy_definition_id = data.azurerm_policy_definition.deploy_laws.id
      name = data.azurerm_policy_definition.deploy_laws.name
      id = data.azurerm_policy_definition.deploy_laws.id
      reference_id         = "deploy_laws"
      parameters = {
        logAnalytics = var.logAnalytics
      }
    }
  ]
}

module configure_asc_initiative {
  source                  = "../../modules/initiative"
  initiative_name         = "b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb"
  initiative_display_name = "[TF]: Deploy Laws"
  initiative_description  = "Deploys and configures Azure laws"
  initiative_category     = "Security Center"
 // management_group_id     = var.mgmt_group_name
  
  # Dynamically generate member_definitions and set parameters inside it
 member_definitions = local.parameters
}

# get all the generated parameter names so we know what to use during assignment
output "list_of_initiative_parameters" {
  value = keys(module.configure_asc_initiative.parameters)
}

output "initiative" {
  value = module.configure_asc_initiative.initiative
}

output "parameters" {
  value = module.configure_asc_initiative.parameters
}

[gettek]

The initiative parameters are automatically created by the module, you only need to provide the definition resource node to member_definitions, e.g. data.azurerm_policy_definition.deploy_laws.

The default value of each definition parameter will be used if none are provided to the set_assignment module assignment_parameters

[AnshuBhatiaGit]

i understand that the initiative parameters are created by the module but if I want to set the default value of one of the initiative parameters in that initiative how do I do that? That's where I am facing issue. For eg. this policy "Configure diagnostic settings for Blob Services to Log Analytics workspace" has four parameters as below
Name Effect
Type String
Default Value DeployIfNotExists
Allowed Values DeployIfNotExists; AuditIfNotExists; Disabled

Name Profile name
Type String
Default Value blobServicesDiagnosticsLogsToWorkspace

Name Log Analytics workspace
Type String

Name Enable metrics
Type Boolean
Default Value
Allowed Values true; false

Name Enable logs
Type Boolean
Default Value
Allowed Values true; false

How do I set the Log Analytics workspace parameter value to "xxxxx"

[gettek]

You will need to import the definition into your local library as a custom definition. You cannot modify built-ins.

If you want to use built-ins, you can supply the Log Analytics workspace during assignment

[AnshuBhatiaGit]

Hi Sadik,
Thanks for replying to my questions.
May be I need to clarify more on my question.
What I am doing in my Azure Portal is

1. Creating an Initiative with built-in definitions
2. Create assignment with that Initiative
3. Then set Initiative parameters in the assignment.

I am trying to achieve the same with Terraform code by implementing your code.

1. Creating an Initiative with built-in definitions - Download the built -in files as json and then create Initiative or I can refer the builtin definition?
2. Create assignment with that Initiative - I am able to achieve this with your code.
3. Then set Initiative parameters in the assignment - This step is not clear how do I set parameters for Initiative in the assignment.
   NOTE: I don't want to set assignment parameters but want to set Initiative parameters.
   If you can guide me in the right direction that would be great.

Thanks,

[gettek]

I'm still a little confused on what you are trying to achieve here.

Once the initiative is created you can use an output to view all acceptable parameters for assignment e.g.:

output "parameters" {
  value = module.configure_asc_initiative.parameters
}

The repo also contains an example Diagnostics assignment which I think is what you are trying to do.

[AnshuBhatiaGit]

Hi @gettek,
I was following the same example but I don’t want to set parameters for an Assignment I want to set parameter values for variables in an Initiative so that all the policies in that Initiative can use those values from the Intiative variables that have set values.
Is there a possibility I can set up 15 min time with you to talk and explain the issue?
I would greatly appreciate that.

Thanks,
Anshu

[AnshuBhatiaGit]

I was able to figure out Thanks @gettek

[gettek]

Thanks, can you share your findings?

[AnshuBhatiaGit]

Hi @gettek ,
I figured out when remediating a policy in an assignment it uses assignment parameters there is no need to set the values for the initiative variables. The remediation step works with the values assigned to assigment parameters.