r/azurerm_xyz_policy_assignment add support for non_compliance_message

internal/services/policy/assignment.go

@@ -6,17 +6,17 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-09-01/policy"
+	"github.com/Azure/azure-sdk-for-go/services/preview/resources/mgmt/2021-06-01-preview/policy"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/policy/parse"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
 	"github.com/hashicorp/terraform-provider-azurerm/utils"
 )
 
 func convertEnforcementMode(mode bool) policy.EnforcementMode {
 	if mode {
-		return policy.Default
+		return policy.EnforcementModeDefault
 	} else {
-		return policy.DoNotEnforce
+		return policy.EnforcementModeDoNotEnforce
 	}
 }
 

internal/services/policy/assignment_base_resource.go

@@ -6,7 +6,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-09-01/policy"
+	"github.com/Azure/azure-sdk-for-go/services/preview/resources/mgmt/2021-06-01-preview/policy"
 	"github.com/hashicorp/terraform-provider-azurerm/helpers/azure"
 	"github.com/hashicorp/terraform-provider-azurerm/helpers/tf"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/identity"
@@ -88,6 +88,10 @@ func (br assignmentBaseResource) createFunc(resourceName, scopeFieldName string)
 				assignment.AssignmentProperties.NotScopes = expandAzureRmPolicyNotScopes(v.([]interface{}))
 			}
 
+			if msgs := metadata.ResourceData.Get("non_compliance_message").([]interface{}); len(msgs) > 0 {
+				assignment.NonComplianceMessages = br.expandNonComplianceMessages(msgs)
+			}
+
 			if _, err := client.Create(ctx, id.Scope, id.Name, assignment); err != nil {
 				return fmt.Errorf("creating %s: %+v", id, err)
 			}
@@ -162,10 +166,12 @@ func (br assignmentBaseResource) readFunc(scopeFieldName string) sdk.ResourceFun
 			if props := resp.AssignmentProperties; props != nil {
 				metadata.ResourceData.Set("description", props.Description)
 				metadata.ResourceData.Set("display_name", props.DisplayName)
-				metadata.ResourceData.Set("enforce", props.EnforcementMode == policy.Default)
+				metadata.ResourceData.Set("enforce", props.EnforcementMode == policy.EnforcementModeDefault)
 				metadata.ResourceData.Set("not_scopes", props.NotScopes)
 				metadata.ResourceData.Set("policy_definition_id", props.PolicyDefinitionID)
 
+				metadata.ResourceData.Set("non_compliance_message", br.flattenNonComplianceMessages(props.NonComplianceMessages))
+
 				flattenedMetaData := flattenJSON(props.Metadata)
 				metadata.ResourceData.Set("metadata", flattenedMetaData)
 
@@ -254,6 +260,10 @@ func (br assignmentBaseResource) updateFunc() sdk.ResourceFunc {
 				update.AssignmentProperties.NotScopes = expandAzureRmPolicyNotScopes(metadata.ResourceData.Get("not_scopes").([]interface{}))
 			}
 
+			if metadata.ResourceData.HasChange("non_compliance_message") {
+				update.AssignmentProperties.NonComplianceMessages = br.expandNonComplianceMessages(metadata.ResourceData.Get("non_compliance_message").([]interface{}))
+			}
+
 			if metadata.ResourceData.HasChange("parameters") {
 				update.AssignmentProperties.Parameters = map[string]*policy.ParameterValuesValue{}
 
@@ -326,6 +336,26 @@ func (br assignmentBaseResource) arguments(fields map[string]*pluginsdk.Schema)
 			},
 		},
 
+		"non_compliance_message": {
+			Type:     pluginsdk.TypeList,
+			Optional: true,
+			Elem: &pluginsdk.Resource{
+				Schema: map[string]*pluginsdk.Schema{
+					"message": {
+						Type:         pluginsdk.TypeString,
+						Required:     true,
+						ValidateFunc: validation.StringIsNotEmpty,
+					},
+
+					"policy_definition_reference_id": {
+						Type:         pluginsdk.TypeString,
+						Optional:     true,
+						ValidateFunc: validation.StringIsNotEmpty,
+					},
+				},
+			},
+		},
+
 		"parameters": {
 			Type:             pluginsdk.TypeString,
 			Optional:         true,
@@ -376,3 +406,43 @@ func (br assignmentBaseResource) flattenIdentity(input *policy.Identity) []inter
 	}
 	return policyAssignmentIdentity{}.Flatten(config)
 }
+
+func (br assignmentBaseResource) flattenNonComplianceMessages(input *[]policy.NonComplianceMessage) []interface{} {
+	results := make([]interface{}, 0)
+
+	if input != nil {
+		for _, v := range *input {
+			output := make(map[string]interface{})
+			output["message"] = v.Message
+			if v.PolicyDefinitionReferenceID != nil {
+				output["policy_definition_reference_id"] = *v.PolicyDefinitionReferenceID
+			}
+			results = append(results, output)
+		}
+	}
+
+	return results
+}
+
+func (br assignmentBaseResource) expandNonComplianceMessages(input []interface{}) *[]policy.NonComplianceMessage {
+	if len(input) == 0 {
+		return nil
+	}
+
+	output := make([]policy.NonComplianceMessage, 0)
+	for _, v := range input {
+		if m, ok := v.(map[string]interface{}); ok {
+			message := utils.String(m["message"].(string))
+			ncm := policy.NonComplianceMessage{
+				Message: message,
+			}
+			if m["policy_definition_reference_id"].(string) != "" {
+				policydefinitionreferenceid := utils.String(m["policy_definition_reference_id"].(string))
+				ncm.PolicyDefinitionReferenceID = policydefinitionreferenceid
+			}
+			output = append(output, ncm)
+		}
+	}
+
+	return &output
+}

internal/services/policy/assignment_management_group_resource_test.go

@@ -44,6 +44,40 @@ func TestAccManagementGroupPolicyAssignment_basicWithBuiltInPolicy(t *testing.T)
 	})
 }
 
+func TestAccManagementGroupPolicyAssignment_basicWithBuiltInPolicyNonComplianceMessage(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_management_group_policy_assignment", "test")
+	r := ManagementGroupAssignmentTestResource{}
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.withBuiltInPolicyNonComplianceMessage(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("non_compliance_message.#").HasValue("1"),
+				check.That(data.ResourceName).Key("non_compliance_message.0.message").HasValue("test"),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.withBuiltInPolicyNonComplianceMessageUpdated(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("non_compliance_message").DoesNotExist(),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.withBuiltInPolicyNonComplianceMessage(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("non_compliance_message.#").HasValue("1"),
+				check.That(data.ResourceName).Key("non_compliance_message.0.message").HasValue("test"),
+			),
+		},
+		data.ImportStep(),
+	})
+}
+
 func TestAccManagementGroupPolicyAssignment_basicWithBuiltInPolicySet(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_management_group_policy_assignment", "test")
 	r := ManagementGroupAssignmentTestResource{}
@@ -73,6 +107,43 @@ func TestAccManagementGroupPolicyAssignment_basicWithBuiltInPolicySet(t *testing
 	})
 }
 
+func TestAccManagementGroupPolicyAssignment_basicWithBuiltInPolicySetNonComplianceMessage(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_management_group_policy_assignment", "test")
+	r := ManagementGroupAssignmentTestResource{}
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.withBuiltInPolicySetNonComplianceMessage(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("non_compliance_message.#").HasValue("1"),
+				check.That(data.ResourceName).Key("non_compliance_message.0.message").HasValue("test"),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.withBuiltInPolicySetNonComplianceMessageUpdated(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("non_compliance_message.#").HasValue("2"),
+				check.That(data.ResourceName).Key("non_compliance_message.0.message").HasValue("test"),
+				check.That(data.ResourceName).Key("non_compliance_message.1.message").HasValue("test2"),
+				check.That(data.ResourceName).Key("non_compliance_message.1.policy_definition_reference_id").HasValue("AINE_MinimumPasswordLength"),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.withBuiltInPolicySetNonComplianceMessage(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("non_compliance_message.#").HasValue("1"),
+				check.That(data.ResourceName).Key("non_compliance_message.0.message").HasValue("test"),
+			),
+		},
+		data.ImportStep(),
+	})
+}
+
 func TestAccManagementGroupPolicyAssignment_basicWithCustomPolicy(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_management_group_policy_assignment", "test")
 	r := ManagementGroupAssignmentTestResource{}
@@ -246,6 +317,63 @@ resource "azurerm_management_group_policy_assignment" "test" {
 `, template, data.RandomString, data.Locations.Primary, data.Locations.Secondary)
 }
 
+func (r ManagementGroupAssignmentTestResource) withBuiltInPolicyNonComplianceMessage(data acceptance.TestData) string {
+	template := r.template(data)
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+%s
+
+data "azurerm_policy_definition" "test" {
+  display_name = "Allowed locations"
+}
+
+resource "azurerm_management_group_policy_assignment" "test" {
+  name                 = "acctestpol-%[2]s"
+  management_group_id  = azurerm_management_group.test.id
+  policy_definition_id = data.azurerm_policy_definition.test.id
+
+  non_compliance_message {
+    message = "test"
+  }
+
+  parameters = jsonencode({
+    "listOfAllowedLocations" = {
+      "value" = ["%[3]s"]
+    }
+  })
+}
+`, template, data.RandomString, data.Locations.Primary)
+}
+
+func (r ManagementGroupAssignmentTestResource) withBuiltInPolicyNonComplianceMessageUpdated(data acceptance.TestData) string {
+	template := r.template(data)
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+%s
+
+data "azurerm_policy_definition" "test" {
+  display_name = "Allowed locations"
+}
+
+resource "azurerm_management_group_policy_assignment" "test" {
+  name                 = "acctestpol-%[2]s"
+  management_group_id  = azurerm_management_group.test.id
+  policy_definition_id = data.azurerm_policy_definition.test.id
+  parameters = jsonencode({
+    "listOfAllowedLocations" = {
+      "value" = ["%[3]s"]
+    }
+  })
+}
+`, template, data.RandomString, data.Locations.Primary)
+}
+
 func (r ManagementGroupAssignmentTestResource) withBuiltInPolicySetBasic(data acceptance.TestData) string {
 	template := r.template(data)
 	return fmt.Sprintf(`
@@ -302,6 +430,71 @@ resource "azurerm_management_group_policy_assignment" "test" {
 `, template, data.RandomString, data.Locations.Primary)
 }
 
+func (r ManagementGroupAssignmentTestResource) withBuiltInPolicySetNonComplianceMessage(data acceptance.TestData) string {
+	template := r.template(data)
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+%s
+
+data "azurerm_policy_set_definition" "test" {
+  display_name = "Audit machines with insecure password security settings"
+}
+
+resource "azurerm_management_group_policy_assignment" "test" {
+  name                 = "acctestpol-%[2]s"
+  management_group_id  = azurerm_management_group.test.id
+  policy_definition_id = data.azurerm_policy_set_definition.test.id
+  location             = %[3]q
+
+  non_compliance_message {
+    message = "test"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+}
+`, template, data.RandomString, data.Locations.Primary)
+}
+
+func (r ManagementGroupAssignmentTestResource) withBuiltInPolicySetNonComplianceMessageUpdated(data acceptance.TestData) string {
+	template := r.template(data)
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+%s
+
+data "azurerm_policy_set_definition" "test" {
+  display_name = "Audit machines with insecure password security settings"
+}
+
+resource "azurerm_management_group_policy_assignment" "test" {
+  name                 = "acctestpol-%[2]s"
+  management_group_id  = azurerm_management_group.test.id
+  policy_definition_id = data.azurerm_policy_set_definition.test.id
+  location             = %[3]q
+
+  non_compliance_message {
+    message = "test"
+  }
+
+  non_compliance_message {
+    message                        = "test2"
+    policy_definition_reference_id = "AINE_MinimumPasswordLength"
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+}
+`, template, data.RandomString, data.Locations.Primary)
+}
+
 func (r ManagementGroupAssignmentTestResource) withCustomPolicyBasic(data acceptance.TestData) string {
 	template := r.templateWithCustomPolicy(data)
 	return fmt.Sprintf(`