Azure / avdaccelerator

AVD Accelerator deployment automation to simplify the setup of AVD (Azure Virtual Desktop) based on best practices
MIT License
342 stars 214 forks source link

AVD Baseline deployment fails due policy violation #701

Closed ThojoUno closed 2 weeks ago

ThojoUno commented 2 weeks ago

What happened? Provide a clear and concise description of the bug, including deployment details.

Using ALZ-Bicep v0.19 prior to AVD Baseline deployment, and fails on RequestDisallowedByPolicy error on Enforce recommended guardrails for Azure Key Vault. Azure Key Vault should use RBAC permission model

Key vault module needs to be updated to use RBAC instead of access policies for Key vault.

Please provide the correlation id associated with your error or bug.

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

What was the expected outcome?

No response

Relevant log output

New-AzDeployment: /home/vsts/work/_temp/38ae158e-e968-459b-89f9-2b7e64ae7b42.ps1:6 Line | 6 | New-AzSubscriptionDeployment -DeploymentName $DeploymentName ` | ~~~~~~~~~~~~~~ | InvalidTemplateDeployment - Long running operation failed with status | 'Failed'. Additional Info:'The template deployment failed because of | policy violation. Please see details for more information.' | RequestDisallowedByPolicy - Resource 'kv-sec-smt-test-usc-xt' was | disallowed by policy. Policy identifiers: | '[{"policyAssignment":{"name":"Enforce recommended guardrails for Azure | Key | Vault","id":"/providers/Microsoft.Management/managementGroups/xxxxxx-landingzones/providers/Microsoft.Authorization/policyAssignments/Enforce-GR-KeyVault"},"policyDefinition":{"name":"Azure Key Vault should use RBAC permission model","id":"/providers/Microsoft.Authorization/policyDefinitions/12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5"},"policySetDefinition":{"name":"Enforce recommended guardrails for Azure Key Vault","id":"/providers/Microsoft.Management/managementGroups/xxxxxxxx/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-KeyVault"}}]'.

[error]PowerShell exited with code '1'.

danycontre commented 2 weeks ago

@ThojoUno thank you for your feedback, we are working on it.

danycontre commented 2 weeks ago

@ThojoUno bug fixed with PR #704