Comments (7)
@anwather - Thanks a lot! It looks good to me. Tried exporting the policy resources from a child MG, built plan and even deployed it. Everything worked as expected.
from enterprise-azure-policy-as-code.
from enterprise-azure-policy-as-code.
According to Use Case 3 in the Desired State Strategy page, that attribute is intended to be used when the Child scope is not under the same management as the Root scope.
I configured my environment based on the descriptions in that document. Is there some other page I should be referencing?
from enterprise-azure-policy-as-code.
If the parent management group is not managed by EPAC - can you just change the deployment root scope in global-settings.json
to point to the parent?
Can you confirm that the parent management group is not managed by EPAC at all? My understanding from the documentation is that if the parent scope is not managed then the inheritedDefinitionsScopes
won't work - and you should set the deploymentRootScope
to point to the parent management group.
If the parent is managed by EPAC then that setting will work.
Let me know how you go - if it is still causing issues we can have a call to sort it out :)
from enterprise-azure-policy-as-code.
from enterprise-azure-policy-as-code.
Experienced the same issue and did some investigation, as I see the inherited policyDefinitions feature is simply not working at the moment.
First of all, currently the https://github.com/Azure/enterprise-azure-policy-as-code/blob/main/Scripts/Helpers/Build-NotScopes.ps1 script throws exception, since it checks if the "scope to inherit from" is not in the ScopeTable, which will always be the case, since the ScopeTable just contains the deploymentRoot and its child scopes as I understand. May adding the "scopes to inherit from" could help?
Later on if I add some quick and dirty fix, the next error will appear here:
https://github.com/Azure/enterprise-azure-policy-as-code/blob/507bdf2f344f51e3fbe2fce3920084b9c7d03736/Scripts/Helpers/Get-AzPolicyResources.ps1#L218C78-L218C78
This line would be the one which tries to add the inherited definitions to some target which is not defined, may here we only should change this to deployedPolicyTable.readOnly
Sorry for not creating some PR on this, but I didn't had enough time to go deep enough, and create some solution I could be proud of :) Hope this helps someone anyways
from enterprise-azure-policy-as-code.
@borondy @DanZab - I've created a fix in a branch called issue387
- are you able to test the fix and see if it resolves your issue? For me I tested by creating a child management group - then pointed my pac environment to that group and attempted to deploy a definition created in a different management group...
from enterprise-azure-policy-as-code.
Related Issues (20)
- Road map
- Improve regression tests
- Assignment always replaced when using userAssignedIdentity HOT 1
- Remediation Task could not be created HOT 3
- Non EPAC exemptions are not being removed. HOT 1
- Outdated Policy-Exemption Schema HOT 2
- EPAC service principal does not have authorization to perform action 'Microsoft.Management/register/action' over scopes HOT 3
- Sudden issues with 'Code bug: Our root is not in this tree' HOT 5
- Build-DeploymentPlans fails in workflow because az.login is using an earlier version of Az.Accounts HOT 9
- Exemption counting does not support paging and fails above 1000 resources
- Not possible to have an exemption against an assignment where the scope is included in the assignment excluded scopes HOT 2
- Exporting policies resources for PSRule throwing exception HOT 4
- BUG - Github workflows fails to evaluate plan path
- Export-AzPolicyResources not producing ampersand in active-exemptions.csv
- Sync-ALZPolicies outdated Assignment files HOT 2
- Check groupNames against policyDefinitionGroups during plan
- Role Assignments that fail due to a read-only resource lock do not throw an error HOT 1
- groupNames missing when exporting existing initiatives HOT 2
- Build-ExemptionsPlan MethodInvocationException HOT 8
- Support for Snowflakev2 policy parameter using builtin assignment ADF_allowed_linked_service_resource_types HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from enterprise-azure-policy-as-code.