Azure / enterprise-azure-policy-as-code

Enterprise-ready Azure Policy-as-Code (PaC) solution (includes Az DevOps pipeline)
https://azure.github.io/enterprise-azure-policy-as-code/
MIT License
435 stars 243 forks source link

EPAC Module Fails to Interpret Boolean Parameters Correctly, Leading to Policy Deployment Error #801

Closed mclgoerg closed 3 weeks ago

mclgoerg commented 4 weeks ago

Describe the bug When deploying Azure Policy definitions using the EPAC module, specifically this policy https://www.azadvertizer.net/azpolicyadvertizer/e2464615-862b-5b44-901b-df87360c25ee.html, the parameter bringYourOwnUserAssignedManagedIdentity is expected to be of type Boolean. Despite specifying this parameter as a Boolean (true without quotes) in the CSV file, the deployment process incorrectly treats it as a String. This mismatch leads to a deployment error, preventing the policy from being assigned as intended.

Error Message Definition error 400 -- IaaS Management --{ "error": { "code": "InvalidPolicyParameterType", "message": "The policy parameter 'bringYourOwnUserAssignedManagedIdentity' does not match the expected parameter type defined in the policy definition 'cross-subscription-uai-to-vm'. Details 'The expected policy parameter type: 'Boolean'. The actual policy parameter type 'String'.'." } }

To Reproduce Steps to reproduce the behavior:

  1. Prepare the CSV File:

Create a CSV file (policy-parameters.csv) with the following content, ensuring that the bringYourOwnUserAssignedManagedIdentity parameter is set as a Boolean (true without quotes):

"name","referencePath","SANDBOXEffect","SANDBOXParameters"
"cross-subscription-uai-to-vm","","DeployIfNotExists","{""bringYourOwnUserAssignedManagedIdentity"":true, ""userAssignedIdentityName"":""my-uai"", ""identityResourceGroup"":""my-rg"", ""identitySubscription"":""my-subscription-id""}"
  1. Run the Deployment Script
  2. Observe the Error The deployment fails with the error message indicating that the bringYourOwnUserAssignedManagedIdentity parameter is of type String instead of Boolean.

Expected behavior The deployment should correctly interpret the bringYourOwnUserAssignedManagedIdentity parameter as a Boolean value and assign the policy without any errors. The policy assignment should recognize the parameter type as Boolean, matching the policy definition's expectations.

Actual behavior Despite specifying the parameter as a Boolean in the CSV file, the deployment process treats it as a String. This results in a type mismatch error, and the policy assignment fails.

Possible Cause It appears that during the CSV parsing and JSON conversion process within the deployment script, the Boolean value true is being converted to a String "true". This may be due to the way the script handles data types when reading from the CSV file.