[666] Update dependency pipeline with policy assignment

.github/workflows/platform.dependencies.yml

@@ -83,6 +83,33 @@ jobs:
           managementGroupId: '${{ secrets.ARM_MGMTGROUP_ID }}'
           removeDeployment: '${{ env.removeDeployment }}'
 
+  job_deploy_pa:
+    runs-on: ubuntu-20.04
+    name: 'Deploy policy assignment'
+    env:
+      namespace: 'Microsoft.Authorization\policyAssignments'
+    needs:
+      - job_deploy_rg
+    strategy:
+      fail-fast: false
+      matrix:
+        parameterFilePaths: ['parameters.json']
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: 'Deploy module'
+        uses: ./.github/actions/templates/deployModule
+        with:
+          templateFilePath: 'arm/${{ env.namespace }}/.bicep/nested_policyAssignments_sub.bicep'
+          parameterFilePath: '${{ env.dependencyPath }}/${{ env.namespace }}/parameters/${{ matrix.parameterFilePaths }}'
+          location: '${{ env.defaultLocation }}'
+          resourceGroupName: '${{ env.resourceGroupName }}'
+          subscriptionId: '${{ secrets.ARM_SUBSCRIPTION_ID }}'
+          managementGroupId: '${{ secrets.ARM_MGMTGROUP_ID }}'
+          removeDeployment: '${{ env.removeDeployment }}'
+
   job_deploy_privateBicepRegistry:
     runs-on: ubuntu-20.04
     name: 'Deploy private bicep registry'

arm/Microsoft.Authorization/policyAssignments/.parameters/min.parameters.json

@@ -3,10 +3,10 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "name": {
-            "value": "Resource location policy"
+            "value": "sxx-pass-vm-disk"
         },
         "policyDefinitionID": {
-            "value": "/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a"
+            "value": "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d"
         },
         "subscriptionId": {
             "value": "<<subscriptionId>>"

arm/Microsoft.Authorization/policyAssignments/.parameters/parameters.json

@@ -3,13 +3,13 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "name": {
+            "value": "sxx-pass-tag"
+        },
+        "displayName": {
             "value": "Add a tag to resources"
         },
         "description": {
-            "value": "Policy Assignment Description"
-        },
-        "displayName": {
-            "value": "Policy Assignment Display Name"
+            "value": "Adds the specified tag and value when any resource missing this tag is created or updated. Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed. Does not modify tags on resource groups."
         },
         "policyDefinitionId": {
             "value": "/providers/Microsoft.Authorization/policyDefinitions/4f9dc7db-30c1-420c-b61a-e1d640128d26"

arm/Microsoft.Authorization/policyExemptions/.parameters/min.parameters.json

@@ -3,10 +3,10 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "name": {
-            "value": "test-policy-exempt-min"
+            "value": "sxx-pexe-loc-rg-min"
         },
         "policyAssignmentId": {
-            "value": "/subscriptions/<<subscriptionId>>/providers/Microsoft.Authorization/policyAssignments/Add-a-tag-to-resources"
+            "value": "/subscriptions/<<subscriptionId>>/providers/Microsoft.Authorization/policyAssignments/adp-sxx-pass-loc-rg"
         },
         "subscriptionId": {
             "value": "<<subscriptionId>>"

arm/Microsoft.Authorization/policyExemptions/.parameters/parameters.json

@@ -3,13 +3,13 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "name": {
-            "value": "test-policy-exempt"
+            "value": "sxx-pexe-loc-rg"
         },
         "displayName": {
             "value": "[Test] policy exempt"
         },
         "policyAssignmentId": {
-            "value": "/subscriptions/<<subscriptionId>>/providers/Microsoft.Authorization/policyAssignments/Add-a-tag-to-resources"
+            "value": "/subscriptions/<<subscriptionId>>/providers/Microsoft.Authorization/policyAssignments/adp-sxx-pass-loc-rg"
         },
         "exemptionCategory": {
             "value": "Waiver"

docs/wiki/TestingDesign.md

@@ -114,6 +114,7 @@ Since also dependency resources are in turn subject to dependencies with each ot
 **Second level resources**: This group of resources has a dependency only on the resource group which will host them. Resources in this group can be deployed in parallel.
 
   1. User assigned identity: This resource is leveraged as a test identity by all resources supporting RBAC.
+  1. Policy assignment: This resource is leveraged by the [policy exemption] resource.
   1. Log analytics workspace: This resource is leveraged by all resources supporting diagnostic settings on LAW.
   1. Storage account: This resource is leveraged by all resources supporting diagnostic settings on a storage account.
       >**Note**: This resource has a global scope name.

utilities/pipelines/dependencies/Microsoft.Authorization/policyAssignments/parameters/parameters.json

@@ -0,0 +1,18 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "name": {
+            "value": "adp-sxx-pass-loc-rg"
+        },
+        "displayName": {
+            "value": "Audit resource location matches resource group location"
+        },
+        "policyDefinitionID": {
+            "value": "/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a"
+        },
+        "subscriptionId": {
+            "value": "<<subscriptionId>>"
+        }
+    }
+}