Comments (6)
{
"$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/policy-exemption-schema.json",
"exemptions": [
// DOES NOT WORK Is trying to create 2 exemptions because there are 2 policy Assignments with different effects
{
"name": "3bc74b9b-91d5-4b47-bc66-574321e4322f",
"displayName": "logging-oms-workspace",
"description": "logging-oms-workspace description",
"exemptionCategory": "Mitigated",
"scope": "/subscriptions/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/resourceGroups/rg-test-resources-d",
"expiresOn": null,
"policySetDefinitionName": "diaglogs-la-initiative",
"policyDefinitionReferenceIds": [
"LALAAGENTWINDOWS"
]
},
// WORKS
{
"name": "62c963c1-00f4-4555-92c3-1dfc9d7207fc",
"displayName": "security-center-pricing-policy via policyset",
"description": "security-center-pricings via policyset description",
"exemptionCategory": "Mitigated",
"scope": "/subscriptions/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/resourceGroups/rg-test-resources-d",
"expiresOn": null,
"policySetDefinitionName": "mg-asc-settings-initiative",
"policyDefinitionReferenceIds": [
"ascstorage"
]
}
]
}
from enterprise-azure-policy-as-code.
If you make the exemption names unique it works?
from enterprise-azure-policy-as-code.
This is what I think is happening:
There is 1 exemption (with a unique name) in the JSON-file, referred by policySetDefinitionName and policyDefinitionReferenceId. EPAC figures out which policyAssignmentId it should take for creating the exemption, but cannot. Since there are 2 assignments, it cannot create 2 exemptions based on 1 unique exemption name.
How can I create a unique exemption name in this scenario?
from enterprise-azure-policy-as-code.
from enterprise-azure-policy-as-code.
I wonder if you will have to use this method to assign the exemption - as it is getting confused because it doesn't know which assignment to look up?
from enterprise-azure-policy-as-code.
Yeah. I was afraid you might say that. I will look into that way. We migrating our old management group structure to the enterprise scale one. We probably have to calculate the new policyAssignmentIds then.
from enterprise-azure-policy-as-code.
Related Issues (20)
- Build-ExemptionsPlan MethodInvocationException HOT 8
- Support for Snowflakev2 policy parameter using builtin assignment ADF_allowed_linked_service_resource_types HOT 2
- Getting the following error when pulling existing exemptions in the plan
- policyGroupName logic is reversed HOT 3
- WARNING: Error, continue deployment: 201 HOT 2
- Error with Get-AzManagementGroup when subscription has deleted or other non-active state HOT 2
- Exemptions skipped in 'Prod Plan - Main Branch' stage HOT 6
- Support for wildcars in the scope(s) segment of an exemptions definition HOT 1
- Exception calling "ContainsKey" with "1" argument(s): "Value cannot be null. (Parameter 'key')" HOT 7
- Fix user assigned managed identity export HOT 2
- Get Existing AzureChinaCloud Exemptions not Returning Non-Management Group Scoped Exemptions HOT 7
- Export-AzPolicyResources Failing for AzureChinaCloud Tenants HOT 3
- Handle role assignments when managed identity is a member of a group HOT 1
- EPAC Plan Taking 15min to run HOT 1
- Error building exemptions with Build-DeploymentPlans HOT 4
- Document All Assignments Option
- Failed exemption deployments do not throw errors HOT 3
- "Deprecated" in policy description for Custom policies will Disable the policy HOT 2
- [Enable Azure Monitor for VMs & VMss] Role assignment when using your own User Assigned Identity located in the caf "management" Management Group HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from enterprise-azure-policy-as-code.