Exemptions should support specifying a Policy or Policy Set in addition to a Policy Assignment

[techlake]

Enhancement

• Policy Definition for the value, will exempt this Policy anywhere
  • Multiple Exemptions created if Policy exists in multiple Assignments (either direct or indirect via one or more Policy Sets)
  • Policy Exemption name must be equal or less than 38 characters long to support creating unique names
  • Display name can still be 128 characters
  • Specifying policyDefinitionReferenceIds is not allowed
• Policy Set Definition for the value will exempt the Policy Set even if assigned multiple times within the inherited scopes
  • Multiple Exemptions created if Policy exists in multiple Assignments (either direct or indirect via one or more Policy Sets)
  • Policy Exemption name must be equal or less than 38 characters long to support creating unique names
  • Display name can still be 128 characters
  • Specifying policyDefinitionReferenceIds is allowed
• Policy Assignments continue to work as is

CSV file impact

• Column policyAssignmentId will only accept Policy Assignments
• To use this feature, rename the column to policyResource
  • Only one of the names is allowed
  • Policy Assignments are allowed as fully qualified names
  • Policy definition:
  • Built-in Policies: fully qualified id
  • Custom Policies: policyDefintion/
  • Policy Set definition:
  • Built-in Policies: fully qualified id
  • Custom Policy Sets policySetDefintion/

JSON file impact

Allow exactly one of the following Policy resource specifiers:

• policyAssignmentId (no change)
• policyDefinitionId (for built-ins)
• policyDefinitionName (for custom)
• policySetDefinitionId (for built-ins)
• policySetDefinitionName (for custom)

[techlake]

Fixed in v10.0.0