diff --git a/.github/workflows/ms.authorization.policyexemptions.yml b/.github/workflows/ms.authorization.policyexemptions.yml index 878f3665c1..f880d599a4 100644 --- a/.github/workflows/ms.authorization.policyexemptions.yml +++ b/.github/workflows/ms.authorization.policyexemptions.yml @@ -109,8 +109,7 @@ jobs: - name: 'Using test file [${{ matrix.moduleTestFilePaths }}]' uses: ./.github/actions/templates/validateModuleDeployment with: - templateFilePath: '${{ env.modulePath }}/deploy.bicep' - parameterFilePath: '${{ env.modulePath }}/${{ matrix.moduleTestFilePaths }}' + templateFilePath: '${{ env.modulePath }}/${{ matrix.moduleTestFilePaths }}' location: '${{ env.location }}' resourceGroupName: '${{ env.resourceGroupName }}' subscriptionId: '${{ secrets.ARM_SUBSCRIPTION_ID }}' diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/mg.common/deploy.test.bicep b/modules/Microsoft.Authorization/policyExemptions/.test/mg.common/deploy.test.bicep new file mode 100644 index 0000000000..621d2bc94f --- /dev/null +++ b/modules/Microsoft.Authorization/policyExemptions/.test/mg.common/deploy.test.bicep @@ -0,0 +1,45 @@ +targetScope = 'managementGroup' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apemgcom' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= + +resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = { + name: 'dep-<>-${serviceShort}-rgloc' + location: location + properties: { + displayName: '[Depedency] Audit resource location matches resource group location (management group scope)' + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a' + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../managementGroup/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyAssignmentId: policyAssignment.id + displayName: '[Display Name] policy exempt (management group scope)' + exemptionCategory: 'Waiver' + expiresOn: '2025-10-02T03:57:00Z' + managementGroupId: last(split(managementGroup().id, '/')) + metadata: { + category: 'Security' + } + } +} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/mg.min.parameters.json b/modules/Microsoft.Authorization/policyExemptions/.test/mg.min.parameters.json deleted file mode 100644 index f5816fcd6d..0000000000 --- a/modules/Microsoft.Authorization/policyExemptions/.test/mg.min.parameters.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-min-mg-polexem" - }, - "policyAssignmentId": { - "value": "/providers/Microsoft.Management/managementGroups/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-mg-pass-loc-rg" - } - } -} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/mg.min/deploy.test.bicep b/modules/Microsoft.Authorization/policyExemptions/.test/mg.min/deploy.test.bicep new file mode 100644 index 0000000000..af4e001bbf --- /dev/null +++ b/modules/Microsoft.Authorization/policyExemptions/.test/mg.min/deploy.test.bicep @@ -0,0 +1,37 @@ +targetScope = 'managementGroup' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apemgmin' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = { + name: 'dep-<>-${serviceShort}-rgloc' + location: location + properties: { + displayName: '[Depedency] Audit resource location matches resource group location (management group scope)' + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a' + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../managementGroup/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyAssignmentId: policyAssignment.id + } +} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/mg.parameters.json b/modules/Microsoft.Authorization/policyExemptions/.test/mg.parameters.json deleted file mode 100644 index 2c76ecb64a..0000000000 --- a/modules/Microsoft.Authorization/policyExemptions/.test/mg.parameters.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-mg-polexem" - }, - "displayName": { - "value": "[Display Name] policy exempt (management group scope)" - }, - "policyAssignmentId": { - "value": "/providers/Microsoft.Management/managementGroups/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-mg-pass-loc-rg" - }, - "exemptionCategory": { - "value": "Waiver" - }, - "metadata": { - "value": { - "category": "Security" - } - }, - "expiresOn": { - "value": "2025-10-02T03:57:00.000Z" - }, - "managementGroupId": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/rg.common/deploy.test.bicep b/modules/Microsoft.Authorization/policyExemptions/.test/rg.common/deploy.test.bicep new file mode 100644 index 0000000000..26f0acbfb8 --- /dev/null +++ b/modules/Microsoft.Authorization/policyExemptions/.test/rg.common/deploy.test.bicep @@ -0,0 +1,55 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'ms.authorization.policyexemptions-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apergcom' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = { + name: 'dep-<>-${serviceShort}-rgloc' + location: location + properties: { + displayName: '[Depedency] Audit resource location matches resource group location (management group scope)' + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a' + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../resourceGroup/deploy.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyAssignmentId: policyAssignment.id + displayName: '[Display Name] policy exempt (resource group scope)' + exemptionCategory: 'Waiver' + expiresOn: '2025-10-02T03:57:00Z' + metadata: { + category: 'Security' + } + resourceGroupName: resourceGroup.name + subscriptionId: subscription().subscriptionId + } +} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/rg.min.parameters.json b/modules/Microsoft.Authorization/policyExemptions/.test/rg.min.parameters.json deleted file mode 100644 index 2573b17fe7..0000000000 --- a/modules/Microsoft.Authorization/policyExemptions/.test/rg.min.parameters.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-min-rg-polexem" - }, - "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" - }, - "subscriptionId": { - "value": "<>" - }, - "resourceGroupName": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/rg.min/deploy.test.bicep b/modules/Microsoft.Authorization/policyExemptions/.test/rg.min/deploy.test.bicep new file mode 100644 index 0000000000..8c3a632989 --- /dev/null +++ b/modules/Microsoft.Authorization/policyExemptions/.test/rg.min/deploy.test.bicep @@ -0,0 +1,49 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'ms.authorization.policyexemptions-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apergmin' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = { + name: 'dep-<>-${serviceShort}-rgloc' + location: location + properties: { + displayName: '[Depedency] Audit resource location matches resource group location (management group scope)' + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a' + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../resourceGroup/deploy.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyAssignmentId: policyAssignment.id + resourceGroupName: resourceGroup.name + subscriptionId: subscription().subscriptionId + } +} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/rg.parameters.json b/modules/Microsoft.Authorization/policyExemptions/.test/rg.parameters.json deleted file mode 100644 index 68fda77deb..0000000000 --- a/modules/Microsoft.Authorization/policyExemptions/.test/rg.parameters.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-rg-polexem" - }, - "displayName": { - "value": "[Display Name] policy exempt (resource group scope)" - }, - "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" - }, - "exemptionCategory": { - "value": "Waiver" - }, - "metadata": { - "value": { - "category": "Security" - } - }, - "expiresOn": { - "value": "2025-10-02T03:57:00.000Z" - }, - "subscriptionId": { - "value": "<>" - }, - "resourceGroupName": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/sub.common/deploy.test.bicep b/modules/Microsoft.Authorization/policyExemptions/.test/sub.common/deploy.test.bicep new file mode 100644 index 0000000000..8b671c72a8 --- /dev/null +++ b/modules/Microsoft.Authorization/policyExemptions/.test/sub.common/deploy.test.bicep @@ -0,0 +1,44 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apesubcom' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = { + name: 'dep-<>-${serviceShort}-rgloc' + location: location + properties: { + displayName: '[Depedency] Audit resource location matches resource group location (management group scope)' + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a' + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../subscription/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyAssignmentId: policyAssignment.id + displayName: '[Display Name] policy exempt (subscription scope)' + exemptionCategory: 'Waiver' + expiresOn: '2025-10-02T03:57:00Z' + metadata: { + category: 'Security' + } + subscriptionId: subscription().subscriptionId + } +} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/sub.min.parameters.json b/modules/Microsoft.Authorization/policyExemptions/.test/sub.min.parameters.json deleted file mode 100644 index 920e7d2add..0000000000 --- a/modules/Microsoft.Authorization/policyExemptions/.test/sub.min.parameters.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-min-sub-polexem" - }, - "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" - }, - "subscriptionId": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/sub.min/deploy.test.bicep b/modules/Microsoft.Authorization/policyExemptions/.test/sub.min/deploy.test.bicep new file mode 100644 index 0000000000..4c3bf31db0 --- /dev/null +++ b/modules/Microsoft.Authorization/policyExemptions/.test/sub.min/deploy.test.bicep @@ -0,0 +1,38 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'apesubmin' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource policyAssignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = { + name: 'dep-<>-${serviceShort}-rgloc' + location: location + properties: { + displayName: '[Depedency] Audit resource location matches resource group location (management group scope)' + policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a' + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../subscription/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + policyAssignmentId: policyAssignment.id + subscriptionId: subscription().subscriptionId + } +} diff --git a/modules/Microsoft.Authorization/policyExemptions/.test/sub.parameters.json b/modules/Microsoft.Authorization/policyExemptions/.test/sub.parameters.json deleted file mode 100644 index 02b3e9037c..0000000000 --- a/modules/Microsoft.Authorization/policyExemptions/.test/sub.parameters.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-sub-polexem" - }, - "displayName": { - "value": "[Display Name] policy exempt (subscription scope)" - }, - "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" - }, - "exemptionCategory": { - "value": "Waiver" - }, - "metadata": { - "value": { - "category": "Security" - } - }, - "expiresOn": { - "value": "2025-10-02T03:57:00.000Z" - }, - "subscriptionId": { - "value": "<>" - } - } -} diff --git a/modules/Microsoft.Authorization/policyExemptions/readme.md b/modules/Microsoft.Authorization/policyExemptions/readme.md index 4b73e8ddd6..e833ed6e37 100644 --- a/modules/Microsoft.Authorization/policyExemptions/readme.md +++ b/modules/Microsoft.Authorization/policyExemptions/readme.md @@ -159,7 +159,7 @@ The following module usage examples are retrieved from the content of the files >**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order. -

Example 1: Mg Min

+

Example 1: Mg.Common

@@ -167,59 +167,16 @@ The following module usage examples are retrieved from the content of the files ```bicep module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicyExemptions' + name: '${uniqueString(deployment().name)}-test-apemgcom' params: { // Required parameters - name: '<>-min-mg-polexem' - policyAssignmentId: '/providers/Microsoft.Management/managementGroups/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-mg-pass-loc-rg' - } -} -``` - -
-

- -

- -via JSON Parameter file - -```json -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - // Required parameters - "name": { - "value": "<>-min-mg-polexem" - }, - "policyAssignmentId": { - "value": "/providers/Microsoft.Management/managementGroups/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-mg-pass-loc-rg" - } - } -} -``` - -
-

- -

Example 2: Mg

- -
- -via Bicep module - -```bicep -module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicyExemptions' - params: { - // Required parameters - name: '<>-mg-polexem' - policyAssignmentId: '/providers/Microsoft.Management/managementGroups/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-mg-pass-loc-rg' + name: '<>apemgcom001' + policyAssignmentId: '' // Non-required parameters displayName: '[Display Name] policy exempt (management group scope)' exemptionCategory: 'Waiver' expiresOn: '2025-10-02T03:57:00Z' - managementGroupId: '<>' + managementGroupId: '' metadata: { category: 'Security' } @@ -241,10 +198,10 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep "parameters": { // Required parameters "name": { - "value": "<>-mg-polexem" + "value": "<>apemgcom001" }, "policyAssignmentId": { - "value": "/providers/Microsoft.Management/managementGroups/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-mg-pass-loc-rg" + "value": "" }, // Non-required parameters "displayName": { @@ -257,7 +214,7 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep "value": "2025-10-02T03:57:00Z" }, "managementGroupId": { - "value": "<>" + "value": "" }, "metadata": { "value": { @@ -271,7 +228,7 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep

-

Example 3: Rg Min

+

Example 2: Mg.Min

@@ -279,14 +236,11 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep ```bicep module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicyExemptions' + name: '${uniqueString(deployment().name)}-test-apemgmin' params: { // Required parameters - name: '<>-min-rg-polexem' - policyAssignmentId: '/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg' - // Non-required parameters - resourceGroupName: '<>' - subscriptionId: '<>' + name: '<>apemgmin001' + policyAssignmentId: '' } } ``` @@ -305,17 +259,10 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep "parameters": { // Required parameters "name": { - "value": "<>-min-rg-polexem" + "value": "<>apemgmin001" }, "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" - }, - // Non-required parameters - "resourceGroupName": { - "value": "<>" - }, - "subscriptionId": { - "value": "<>" + "value": "" } } } @@ -324,7 +271,7 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep

-

Example 4: Rg

+

Example 3: Rg.Common

@@ -332,11 +279,11 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep ```bicep module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicyExemptions' + name: '${uniqueString(deployment().name)}-test-apergcom' params: { // Required parameters - name: '<>-rg-polexem' - policyAssignmentId: '/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg' + name: '<>apergcom001' + policyAssignmentId: '' // Non-required parameters displayName: '[Display Name] policy exempt (resource group scope)' exemptionCategory: 'Waiver' @@ -344,8 +291,8 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep metadata: { category: 'Security' } - resourceGroupName: '<>' - subscriptionId: '<>' + resourceGroupName: '' + subscriptionId: '' } } ``` @@ -364,10 +311,10 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep "parameters": { // Required parameters "name": { - "value": "<>-rg-polexem" + "value": "<>apergcom001" }, "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" + "value": "" }, // Non-required parameters "displayName": { @@ -385,10 +332,10 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep } }, "resourceGroupName": { - "value": "<>" + "value": "" }, "subscriptionId": { - "value": "<>" + "value": "" } } } @@ -397,7 +344,7 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep

-

Example 5: Sub Min

+

Example 4: Rg.Min

@@ -405,13 +352,14 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep ```bicep module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicyExemptions' + name: '${uniqueString(deployment().name)}-test-apergmin' params: { // Required parameters - name: '<>-min-sub-polexem' - policyAssignmentId: '/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg' + name: '<>apergmin001' + policyAssignmentId: '' // Non-required parameters - subscriptionId: '<>' + resourceGroupName: '' + subscriptionId: '' } } ``` @@ -430,14 +378,17 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep "parameters": { // Required parameters "name": { - "value": "<>-min-sub-polexem" + "value": "<>apergmin001" }, "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" + "value": "" }, // Non-required parameters + "resourceGroupName": { + "value": "" + }, "subscriptionId": { - "value": "<>" + "value": "" } } } @@ -446,7 +397,7 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep

-

Example 6: Sub

+

Example 5: Sub.Common

@@ -454,11 +405,11 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep ```bicep module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-PolicyExemptions' + name: '${uniqueString(deployment().name)}-test-apesubcom' params: { // Required parameters - name: '<>-sub-polexem' - policyAssignmentId: '/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg' + name: '<>apesubcom001' + policyAssignmentId: '' // Non-required parameters displayName: '[Display Name] policy exempt (subscription scope)' exemptionCategory: 'Waiver' @@ -466,7 +417,7 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep metadata: { category: 'Security' } - subscriptionId: '<>' + subscriptionId: '' } } ``` @@ -485,10 +436,10 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep "parameters": { // Required parameters "name": { - "value": "<>-sub-polexem" + "value": "<>apesubcom001" }, "policyAssignmentId": { - "value": "/subscriptions/<>/providers/Microsoft.Authorization/policyAssignments/adp-<>-sb-pass-loc-rg" + "value": "" }, // Non-required parameters "displayName": { @@ -506,7 +457,56 @@ module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep } }, "subscriptionId": { - "value": "<>" + "value": "" + } + } +} +``` + +
+

+ +

Example 6: Sub.Min

+ +
+ +via Bicep module + +```bicep +module policyExemptions './Microsoft.Authorization/policyExemptions/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-apesubmin' + params: { + // Required parameters + name: '<>apesubmin001' + policyAssignmentId: '' + // Non-required parameters + subscriptionId: '' + } +} +``` + +
+

+ +

+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + // Required parameters + "name": { + "value": "<>apesubmin001" + }, + "policyAssignmentId": { + "value": "" + }, + // Non-required parameters + "subscriptionId": { + "value": "" } } }