Azure Policies via Terraform - azure

Question

Working on a code to apply CIS policies set via code to track changes. What I am trying to do is create a custom policy set that contains the policies within CIS Microsoft Azure Foundation Benchmark v1.4.0 initiative definition. I am using the Terraform’s azurerm_policy_set_definition but repeatedly encounter a listofAllowedLocations issue.
Code:
data "azurerm_management_group" "Standard" {
display_name = "Standard"
}
resource "azurerm_policy_set_definition" "cis_benchmark" {
name = var.cis_policy_name
policy_type = "Custom"
display_name = var.cis_display_name
lifecycle {
create_before_destroy = true
}
parameters = local.parameters
metadata = local.metadata
policy_definition_reference {
policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988"
parameter_values = <<VALUE
{
"allowedLocation": {"value": ["eastus"]}
}
VALUE
}
}
Error:
Error: creating Policy Set Definition "CIS Benchmark v1.4.0": policy.SetDefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="MissingPolicyParameter" Message="The policy set definition 'CIS Benchmark v1.4.0' is missing the parameter(s) 'listOfAllowedLocations' as defined in the policy definition 'e765b5de-1225-4ba3-bd56-1ac6695af988'."
│
│ with azurerm_policy_set_definition.cis_benchmark,│ on cisbenchmark.tf line 22, in resource "azurerm_policy_set_definition" "cis_benchmark":
│ 22: resource "azurerm_policy_set_definition" "cis_benchmark" {
│

Answer 1

You misspelled the parameter name allowedLocation, which should be listOfAllowedLocations. Take a close look at the example below, this should solve your issue. I agree it is a bit confusing that the names differ.
resource "azurerm_policy_set_definition" "example" {
name = "testPolicySet"
policy_type = "Custom"
display_name = "Test Policy Set"
parameters = <<PARAMETERS
{
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
PARAMETERS
policy_definition_reference {
policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988"
parameter_values = <<VALUE
{
"listOfAllowedLocations": {"value": "[parameters('allowedLocations')]"}
}
VALUE
}
}
I got this example from the official policy_set_definition documentation.