search

Azure / enterprise-azure-policy-as-code

Enterprise-ready Azure Policy-as-Code (PaC) solution (includes Az DevOps pipeline)
https://azure.github.io/enterprise-azure-policy-as-code/
MIT License
432 stars 239 forks source link

keepDfcSecurityAssignments not working as expected #484

Closed tsunami28 closed 8 months ago

tsunami28 commented 8 months ago

policy-plan.json global-settings copy.jsonc

Based on the "global-settings" file attached running a "build-deploymentPlans" gives the output (attached plan) in which it is stated that all ASC assignments will be removed.

Based on this docs it shouldn't happen.

Our code is fully synced with with this repo origin.

tsunami28 commented 8 months ago

image

The image shows just an example of roles that are to be removed too, and are used by ASC.

techlake commented 8 months ago

Those are role assignments. the internals of the built-ins could have been changed.

Do you see assignments being removed?

tsunami28 commented 8 months ago

Hi @techlake . In the first message I have attached policy-plan file that shows that assignments will be removed. Role part is just addition to that.

tsunami28 commented 8 months ago

Update from my side. The behavior is not the same when I locally run "build-deploymentPlans" and when it is triggered within the pipeline (from starter set). Problem described above is local behavior and within the pipeline it skips ACS assignments as expected.