Anyone know how to format an “Array” parameter in Azure policy? Here is the code. All parameters require a string except listOfLocations, which requires an array. I’ve tried everything under the sun, even passing literals and jsonencoding the array. Here is the current code and the error produced.
variable "policy_initiatives" {
type = list(object({
policy_initiative = string
policy_list = list(object({
policy = string
effect = string
set_log_location = bool # Used for rules that require a Log Analytics Location with parameter "logAnalytics"
set_log_location_id = bool # Used for rules that require a Log Analytics Location with parameter "logAnalyticsWorkspaceID"
regions = list(string)
operation = string
retention_days = string # The required diagnostic logs retention in days with parameter "requiredRetentionDays"
set_log_rg_name = bool # The resource group where the storage location resides. Set using parameter "rgName"
set_storage_prefix = bool # The storage prefix name to prepend to the storage blob. Set using parameter "storagePrefix"
}))
}))
description = "List of policy definitions (display names) for the Security Governance policyset"
default = [
{
policy_initiative = "Security Governance"
policy_list = [
{
policy = "Network Watcher should be enabled"
effect = null
set_log_location = false
set_log_location_id = false
regions = ["East US", "West US"]
operation = null
retention_days = null
set_log_rg_name = false
set_storage_prefix = false
}
resource "azurerm_policy_set_definition" "security_governance" {
name = "Security governance"
policy_type = "Custom"
display_name = "Security Governance"
description = "Assignment of the Security Governance initiative to subscription."
metadata = <<METADATA
{
"category": "${var.policyset_definition_category}"
}
METADATA
dynamic "policy_definition_reference" {
for_each = data.azurerm_policy_definition.security_governance
content {
policy_definition_id = policy_definition_reference.value.id
reference_id = policy_definition_reference.value.id
parameters = {
Effect = lookup(local.policy_initiatives_policy_map, policy_definition_reference.key, null)
logAnalytics = lookup(local.policy_initiatives_log_map, policy_definition_reference.key, null)
logAnalyticsWorkspaceID = lookup(local.policy_initiatives_log_workspace_id_map, policy_definition_reference.key, null)
operationName = lookup(local.policy_initiatives_operation_map, policy_definition_reference.key, null)
listOfLocations = lookup(local.policy_initiatives_region_map, policy_definition_reference.key, null) == null ? null : lookup(local.policy_initiatives_region_map, policy_definition_reference.key, null)
requiredRetentionDays = lookup(local.policy_initiatives_retention_days_map, policy_definition_reference.key, null)
rgName = lookup(local.policy_initiatives_rgname_map, policy_definition_reference.key, null)
storagePrefix = lookup(local.policy_initiatives_storageprefix_map, policy_definition_reference.key, null)
}
}
}
}
Inappropriate value for attribute "parameters": element "listOfLocations":
string required.
The Azure policy definition says it requires an Array type. Here is the policy definition that I’m attempting to assign into a policy initiative (policy set):
"properties": {
"displayName": "Network Watcher should be enabled",
"policyType": "BuiltIn",
"mode": "All",
"description": "Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Scenario level monitoring enables you to diagnose problems at an end to end network level view. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure.",
"metadata": {
"version": "1.0.0",
"category": "Network"
},
"parameters": {
"listOfLocations": {
"type": "Array",
"metadata": {
"displayName": "Locations",
"description": "Audit if Network Watcher is not enabled for region(s).",
"strongType": "location"
}
}
}