azurerm_policy_set_definition policy_definition_id fails validation in 3.16.0, for built in policy_set expects scope to be prepended

[jasoncaltonkroger]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.0

AzureRM Provider Version

3.16.0

Affected Resource(s)/Data Source(s)

azurerm_policy_assignment

Terraform Configuration Files

data "azurerm_policy_set_definition" "should_have_flow_logs_for_network_security_groups_TEST" {
  display_name = "Flow logs should be configured and enabled for every network security group"
}

resource "azurerm_policy_set_definition" "CIS_1_1" {
  name                 = "CIS_1_1"

  policy_definition_reference {
    policy_definition_id = data.azurerm_policy_set_definition.should_have_flow_logs_for_network_security_groups_TEST.id
    reference_id         = data.azurerm_policy_set_definition.should_have_flow_logs_for_network_security_groups_TEST.id
    parameter_values = jsonencode({
      "effect" : {
        "value" : "Audit"
      }
    })
  }
}

Debug Output/Panic Output

│ Error: cannot parse "policy_definition_reference.22.policy_definition_id" as a Policy Definition ID: unable to parse Policy Definition ID "/providers/Microsoft.Authorization/policySetDefinitions/62329546-775b-4a3d-a4cb-eb4bb990d2c0"
│

Expected Behaviour

Policy Set Assignment should be created

Actual Behaviour

│ Error: cannot parse "policy_definition_reference.22.policy_definition_id" as a Policy Definition ID: unable to parse Policy Definition ID "/providers/Microsoft.Authorization/policySetDefinitions/62329546-775b-4a3d-a4cb-eb4bb990d2c0"
│

Steps to Reproduce

terraform apply

Important Factoids

No response

References

Same issue as #6671 (which was marked fixed in AzureRM provider 2.9)

[jasoncaltonkroger]

@ArcturusZhang Looks like you previously fixed this for issue #6671, but I am still seeing the error.

[wuxu92]

Hi @jasoncaltonkroger did you update azurerm from v2 to v3.16.0? azurerm_policy_assignment has been removed in the upgrade to v3 https://github.com/hashicorp/terraform-provider-azurerm/blob/main/website/docs/guides/3.0-upgrade-guide.html.markdown#resource-azurerm_policy_assignment

[jasoncaltonkroger]

Hi @jasoncaltonkroger did you update azurerm from v2 to v3.16.0? azurerm_policy_assignment has been removed in the upgrade to v3 https://github.com/hashicorp/terraform-provider-azurerm/blob/main/website/docs/guides/3.0-upgrade-guide.html.markdown#resource-azurerm_policy_assignment

Sorry, that was a bad copy/paste. I have updated the above. I meant to write "azurerm_policy_set_definition", not "azurerm_policy_assignment"

[wuxu92]

Hi @jasoncaltonkroger could you please update the configuration file for azurerm_policy_set_definition it seems like missing some required properties like display_name and policy_type

[wuxu92]

HI @jasoncaltonkroger the property policy_definition_reference.policy_definition_id should reference an id of policy_defintion not an id of the policy set definition. maybe you should use data.azurerm_policy_set_definition.should_have_flow_logs_for_network_security_groups_TEST.policy_definition_reference[0].policy_definition_id.

[jasoncaltonkroger]

@wuxu92 The documentation says it can be either:

policy_definition_id - (Required) The ID of the policy definition or policy set definition that will be included in this policy set definition.

[wuxu92]

@wuxu92 Xu Wu FTE The documentation says it can be either:

policy_definition_id - (Required) The ID of the policy definition or policy set definition that will be included in this policy set definition.

Hi @jasoncaltonkroger sorry for my late response. i have tried with policy_set_definition id to create the policy_set_definition, the server response error as Status=400 Code="InvalidCreatePolicySetDefinitionRequest" Message="The policy set definition 'CIS_1_1' request is invalid. Referenced policy definitions must be of type 'Microsoft.Authorization/policyDefinitions'." so I believe it's a document misleading, and I'll raise a pr to update the document.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.