Azure Policy using azurerm_subscription_policy_assignment passing User Defined Parameters with json

[PatBolkun]

Hi Folks, I'm in the process of implementing OpenTofu and am struggling to pass User Defined Parameters to specific definitions of a policy definition set (initiative). At this time I'm able to deploy one or the other set of parameters for an initiative. The error I'm receiving is "Inappropriate value for attribute "parameters": string required." which occurs because I'm passing an int / number type in one of the definition parameters. This implementation works without issue if I deploy one or the other.

I'm currently using a child and root module design pattern. I'll expand upon this below. Anything commented out if an implementation that I've attempted to use.

Child Module main.tf:

resource "azurerm_subscription_policy_assignment" "policy-assignment-sub" {
  name                  = var.name
  subscription_id       = "/subscriptions/${var.subscription_id}"
  enforce               = var.enforce
  policy_definition_id  = var.policy_definition_id
  description           = var.description
  display_name          = var.display_name
#  parameters            = [
#    for key, value in var.parameters : {
#      key   = key
#      value = value
#    }
#  ]
  parameters            = tomap(var.parameters)
#  parameters  = length(var.parameters) > 0 ? jsonencode(var.parameters) : null
  location              = var.location

  identity {
    type = var.identity_type

    identity_ids = var.identity_type == "UserAssigned" ? var.identity_ids : null
  }
}

Child Module: variables.tf:

variable "name" {
  description = "The name of the policy assignment."
  type        = string
}

variable "subscription_id" {
  description = "The ID of the subscription where the policy will be assigned."
  type        = string
}

variable "policy_definition_id" {
  description = "The ID of the policy definition to assign."
  type        = string
}

variable "enforce" {
  description = "The enforcement mode of the policy assignment."
  type        = bool
  default     = "false"

}

variable "description" {
  description = "A description of the policy assignment."
  type        = string
  default     = ""
}

variable "display_name" {
  description = "The display name of the policy assignment."
  type        = string
  default     = ""
}

variable "location" {
  description = "The location where the policy assignment is created. This is required for certain resource types."
  type        = string
  default     = ""
}

variable "identity_type" {
  description = "The type of managed identity for the policy assignment. Possible values are SystemAssigned or UserAssigned."
  type        = string
  default     = "SystemAssigned"
}

variable "identity_ids" {
  description = "A list of User Managed Identity IDs to assign to the Policy Definition, used only if identity_type is UserAssigned."
  type        = list(string)
  default     = []
}

variable "parameters" {
  description = "Map of parameters for the policy assignment."
  type        = map(object({
    value = any
  }))
  default     = {}
}

variable "policy_parameters" {
  description = "Map of parameters for the policy assignment."
  type        = object({
  })
  default     = {}
}

Root Module Main.tf:

module "policy_assignments" {
  source = "../../modules/policy_assignment_subscription"

  for_each = tomap({ for policy in local.policy_initative_assignments : policy.name => policy })

  name                 = each.value.name
  subscription_id      = var.subscription_id
  policy_definition_id = each.value.policy_definition_id
  description          = each.value.description
  display_name         = each.value.display_name
#  parameters           = each.value.parameters
  parameters = tomap({
    for k, v in var.parameters : k => jsonencode(v.value)
  })
  enforce              = each.value.enforce
  location             = var.location

  identity_type = "SystemAssigned" # or "UserAssigned"

  # Uncomment and set identity_ids if using UserAssigned identities
  # identity_ids      = ["<identity-id-1>", "<identity-id-2>"]
}

Root Module locals.tf:

locals {
  cismicrosoftazurefoundationsbenchmark2_json_parameters = jsondecode(file("./initative_parameters/cismicrosoftazurefoundationsbenchmark2.parameters.json"))
  mscp_json_parameters = jsondecode(file("./initative_parameters/mscp.parameters.json"))
  policy_initative_assignments = [
    {
      name                 = "NIST SP 800-53 Rev. 5 ACIT ${var.subscription_name}"
      enforce              = false
      policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/179d1daa-458f-4e47-8086-2a68d0d6c38f"
      description          = "National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 provides a standardized approach for assessing, monitoring and authorizing cloud computing products and services to manage information security risk. These policies address a subset of NIST SP 800-53 R5 controls. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/nist800-53r5-initiative."
      display_name         = "NIST SP 800-53 Rev. 5"
      parameters           = {}
    },
    {
      name                 = "Microsoft Cloud Security Benchmark ${var.subscription_name}"
      enforce              = false
      policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8"
      description          = "The Microsoft cloud security benchmark (MCSB) provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services on Azure and your multi-cloud environment. This benchmark focuses on cloud-centric control areas with input from a set of holistic Microsoft and industry security guidance."
      display_name         = "Microsoft Cloud Security Benchmark"
      parameters           = {
        "installLogAnalyticsAgentOnVmMonitoringEffect" = local.mscp_json_parameters.installLogAnalyticsAgentOnVmMonitoringEffect
        "resolveLogAnalyticsHealthIssuesMonitoringEffect" = local.mscp_json_parameters.resolveLogAnalyticsHealthIssuesMonitoringEffect
      }
    }, 
    {
      name                 = "CIS Microsoft Azure Foundations Benchmark v2.0.0 ${var.subscription_name}"
      enforce              = false
      policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/06f19060-9e68-4070-92ca-f15cc126059e"
      description          = "The security guidance provided by Center for Internet Security for establishing a secure baseline configuration for Azure. The scope of the benchmark is to establish the foundation level of security while adopting Azure Cloud."
      display_name         = "CIS Microsoft Azure Foundations Benchmark"
      parameters = {
        "maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44" = 90
        }
    }
  ]
}

./initative_parameters/cismicrosoftazurefoundationsbenchmark2.parameters.json

  "maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44": {
    "value": 90
  }
}

mcsp.parameters.json:

{
  "installLogAnalyticsAgentOnVmMonitoringEffect": {
    "value": "AuditIfNotExists"
  },
  "resolveLogAnalyticsHealthIssuesMonitoringEffect": {
    "value": "AuditIfNotExists"
  }
}

Root Module variables.tf

variable "subscription_name" {
  description = "The subscription to deploy to (e.g., development, production, government)."
  type        = string
}

variable "subscription_id" {
  description = "The ID of the subscription to deploy to. Passed through the workflow environment."
  type        = string
}

variable "tenant_id" {
  description = "The ID of the tenant to deploy to. Passed through the workflow environment."
  type        = string
}

variable "client_id" {
  description = "The ID of the client to deploy as. Passed through the workflow environment."
  type        = string
}

variable "location" {
  description = "The location where the policy assignment will be created."
  type        = string
  default     = "centralus"
}

variable "parameters" {
  description = "A map of any parameters for the policy assignment."
  type        = map(any)
  default     = {}
}

variable "rotation_days" {
  description = "The maximum number of days to rotate, dynamically set."
  type        = number
  default     = 90
  validation {
    condition     = can(tonumber(var.rotation_days))
    error_message = "rotation_days must be a number."
  }
}

variable "policy_parameters" {
  description = "Map of parameters for the policy assignment."
  type        = map(object({
    value = any
  }))
  default     = {}
}

variable "maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44" {
  description = "The maximum number of days to rotate."
  type        = number
  default     = 90
  validation {
    condition     = can(tonumber(var.maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44))
    error_message = "maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44 must be a number."
  }
}

Root Module test.tfvars:

subscription_name = "test"
subscription_id   = "testSubscription ID"
location          = "eastus"

#rotation_days     = 90

I'm using the following commands:

tofu init 
   -backend-config="" 
   -backend-config="subscription_id=" 
   -backend-config="tenant_id="
   -backend-config="client_id="

tofu plan 
    -var-file="" -var="subscription_id=" 
    -var="client_id="
    -var="tenant_id="

tofu apply
    -var-file="" -var="subscription_id=" 
    -var="client_id="
    -var="tenant_id="

Any insight or thoughts would be helpful to bypass this type conversion issue. Thank you in advanced, I will keep a close eye to this thread.

[abstractionfactory]

Hey @PatBolkun unfortunately, I can't help you with the Azure provider because I don't use it myself, but if you don't get help here, try the OpenTofu Slack.

[PatBolkun]

Thanks for the heads up @abstractionfactory. I'll go check it out, that may be better suited for this case,