[Azure Policies] Support for Non-compliance messages

[evrimsenturk]

Requested feature

Incorporation of non-compliance messages in CAF Entreprise Scale Framework

Documentation

https://docs.microsoft.com/en-gb/azure/governance/policy/concepts/assignment-structure#non-compliance-messages

Example

In the policy assignment, please note nonComplianceMessages attribute

{
    "properties": {
        "displayName": "Enforce resource naming rules",
        "description": "Force resource names to begin with DeptA and end with -LC",
        "metadata": {
            "assignedBy": "Cloud Center of Excellence"
        },
        "enforcementMode": "DoNotEnforce",
        "notScopes": [],
        "policyDefinitionId": "/subscriptions/{mySubscriptionID}/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
        "nonComplianceMessages": [
            {
                "message": "Resource names must start with 'DeptA' and end with '-LC'."
            }
        ],
        "parameters": {
            "prefix": {
                "value": "DeptA"
            },
            "suffix": {
                "value": "-LC"
            }
        }
    }
}

[jtracey93]

Hey @evrimsenturk,

I believe this will require the azurerm provider to support the new property on policy assignments before this could be added to this module. However I agree it's a great thing to have added, when we can 👍

I have already opened an issue on the azurerm provider repo: hashicorp/terraform-provider-azurerm#10697

Please feel free to add a +1 to the issue above so it can be prioritised 👍

Thanks 😀

[evrimsenturk]

Hello @jtracey93

Thanks for the quick feedback, I have added +1 on the issue #10697

Cheers

[krowlandson]

Thank you for your request @evrimsenturk ... as @jtracey93 says, we are dependent on the AzureRM provider before we can add this capability. This will also need to be aligned to a major release as it will re-baseline backward compatibility for older provider versions.

I've added this to our backlog and we'll look to add this once available.

[krowlandson]

Tagging hashicorp/terraform-provider-azurerm/issues/10401 as this is now the active issue for this feature request on the provider.

[matt-FFFFFF]

See upstream PR:

• r/azurerm_xyz_policy_assignment add support for non_compliance_message hashicorp/terraform-provider-azurerm#14518

[krowlandson]

Now unblocked with release v2.90.0 of the Azure provider, but adding to v2.0.0 release milestone until we determine whether this will require a breaking change on templates.

[jtracey93]

I agree @krowlandson we could do this upstream so all implementations benefit 👍
@matt-FFFFFF agree?

[jtracey93]

Trigger ADO Sync