Azure / enterprise-azure-policy-as-code

Enterprise-ready Azure Policy-as-Code (PaC) solution (includes Az DevOps pipeline)
https://azure.github.io/enterprise-azure-policy-as-code/
MIT License
410 stars 216 forks source link

Build-DeploymentPlans function fails when trying to builtin and custom policy sets to as exemptions #608

Closed doenoe closed 4 months ago

doenoe commented 4 months ago

Describe the bug When trying to add builtin or custom policy sets as exemptions via a .jsonc file as described here, the Build-DeploymentPlans function fails with the following error:

Confirm-PolicySetDefinitionUsedExists: C:\Users\user\Documents\PowerShell\Modules\EnterprisePolicyAsCode\10.2.1\internal\functions\Build-ExemptionsPlan.ps1:375:29
Line |
 375 |                              -PolicySetDefinitionsScopes $PacEnvironme …
     |                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | A parameter cannot be found that matches parameter name 'PolicySetDefinitionsScopes'.

I tried to debug the error and I found that the Build-DeploymentPlans calls theBuild-ExemptionPlans function, which again calls the Confirm-PolicySetDefinitionUsedExists function. The Confirm-PolicySetDefinitionUsedExists function is called with a -PolicySetDefinitionsScopes parameter which is not present in the Confirm-PolicySetDefinitionUsedExists.ps1 file, there is however a parameter present in the file with quite a similar name called PolicyDefinitionsScopes.

To Reproduce Create a .jsonc file and add a custom or builtin policy set to exempt and run the Build-DeploymentPlans function.

Expected behavior Build-DeploymentPlans should run without errors.

EPAC Version 10.2.1 - EnterprisePolicyAsCode
2.19.0 - Az.Accounts
0.13.1 - Az.ResourceGraph
6.16.2 - Az.Resources

techlake commented 4 months ago

Fixed in v10.2.2

doenoe commented 4 months ago

The Build-DeploymentPlans function now fails on another unfound parameter:

Confirm-PolicySetDefinitionUsedExists: C:\Users\user\Documents\PowerShell\Modules\EnterprisePolicyAsCode\10.2.2\internal\functions\Build-ExemptionsPlan.ps1:401:29
Line |
 401 |                              -AllDefinitions $AllDefinitions.policyset …
     |                              ~~~~~~~~~~~~~~~
     | A parameter cannot be found that matches parameter name 'AllDefinitions'.

After changing the parameter name to 'AllDefinitions' the function results in the following error messages:


===================================================================================================
Processing Policy Assignments JSON files in folder 'Definitions/policyAssignments'
===================================================================================================
Number of Policy Assignment files = 37
Confirm-PolicySetDefinitionUsedExists: C:\Users\user\Documents\PowerShell\Modules\EnterprisePolicyAsCode\10.2.2\internal\functions\Build-AssignmentDefinitionEntry.ps1:49:17
Line |
  49 |                  -AllPolicySetDefinitions $CombinedPolicyDetails.polic …
     |                  ~~~~~~~~~~~~~~~~~~~~~~~~
     | A parameter cannot be found that matches parameter name 'AllPolicySetDefinitions'.
InvalidOperation: C:\Users\user\Documents\PowerShell\Modules\EnterprisePolicyAsCode\10.2.2\internal\functions\Build-AssignmentDefinitionEntry.ps1:82:13
Line |
  82 |              $normalizedEntry.displayName = $DefinitionEntry.displayNa …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | The property 'displayName' cannot be found on this object. Verify that the property exists and can be set.
InvalidOperation: C:\Users\user\Documents\PowerShell\Modules\EnterprisePolicyAsCode\10.2.2\internal\functions\Build-AssignmentDefinitionEntry.ps1:116:13
Line |
 116 |              $normalizedEntry.assignment = @{
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | The property 'assignment' cannot be found on this object. Verify that the property exists and can be set.
Write-Error: C:\Users\user\Documents\PowerShell\Modules\EnterprisePolicyAsCode\10.2.2\functions\Build-DeploymentPlans.ps1:310:9
Line |
 310 |          Build-AssignmentPlan `
     |          ~~~~~~~~~~~~~~~~~~~~~~
     | Assignment definitions content errors