Deploy ALZ custom policies when using deploy_core_landing_zones

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform: 1.9.2

azure provider: 3.114

module: 6.0.0

Description

Describe the bug

I'm trying to deploy a custom management group hierarchy similar to es-lite. The Terraform plan gives those 2 errors:

Error: reading Policy Set Definition "Enforce-EncryptTransit_20240509": policy.SetDefinitionsClient#GetAtManagementGroup: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="PolicySetDefinitionNotFound" Message="The policy set definition 'Enforce-EncryptTransit_20240509' could not be found."

Error: reading Policy Set Definition "Deploy-AUM-CheckUpdates": policy.SetDefinitionsClient#GetAtManagementGroup: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="PolicySetDefinitionNotFound" Message="The policy set definition 'Deploy-AUM-CheckUpdates' could not be found."

Steps to Reproduce

main.tf

module "enterprise_scale" {
  source     = "Azure/caf-enterprise-scale/azurerm"
  version    = "6.0.0"

  default_location          = local.default_location
  deploy_core_landing_zones = false
  root_parent_id            = data.azurerm_client_config.core.tenant_id
  root_id                   = local.alz_root_id
  root_name                 = local.alz_root_name

  providers = {
    azurerm              = azurerm
    azurerm.connectivity = azurerm
    azurerm.management   = azurerm
  }

  archetype_config_overrides = {
    landing-zones = {
      archetype_id = "es_landing_zones"
      parameters = {
        Audit-AppGW-WAF = {
          effect = "Disabled"
        }
        Deny-IP-forwarding = {
          effect = "Audit"
        }
        Deny-MgmtPorts-Internet = {
          effect = "Audit"
        }
        Deploy-AzSqlDb-Auditing = {
          effect = "Audit"
        }
        Deploy-MDFC-DefSQL-AMA = {
          userWorkspaceResourceId = ""
        }
        Deploy-VM-Backup = {
          effect = "Disabled"
        }
        Deploy-VM-ChangeTrack = {
          effect = "Disabled"
        }
        Deploy-VM-Monitoring = {
          effect = "Audit"
        }
        Deploy-vmArc-ChangeTrack = {
          effect = "Disabled"
        }
        Deploy-vmHybr-Monitoring = {
          effect = "Disabled"
        }
        Deploy-VMSS-ChangeTrack = {
          effect = "Disabled"
        }
        Deploy-VMSS-Monitoring = {
          effect = "Audit"
        }
        Enable-DDoS-VNET = {
          effect = "Disabled"
        }
        Enforce-AKS-HTTPS = {
          effect = "Disabled"
        }
      }
      access_control = {}
    }
    platform = {
      archetype_id = "es_platform"
      parameters = {
        Deploy-VM-Backup = {
          effect = "Disabled"
        }
        Deploy-VM-ChangeTrack = {
          effect = "Disabled"
        }
        Deploy-VM-Monitoring = {
          effect = "Audit"
        }
        Deploy-vmArc-ChangeTrack = {
          effect = "Disabled"
        }
        Deploy-vmHybr-Monitoring = {
          effect = "Disabled"
        }
        Deploy-VMSS-ChangeTrack = {
          effect = "Disabled"
        }
        Deploy-VMSS-Monitoring = {
          effect = "Audit"
        }
      }
      access_control = {}
    }
  }

  custom_landing_zones = {
    "${local.alz_root_id}-platform" = {
      display_name               = "${upper(local.alz_root_name)} Platform"
      parent_management_group_id = local.alz_root_id
      subscription_ids           = []
      archetype_config = {
        archetype_id = "es_platform"
        parameters = {}
        access_control = {}
      }
    }
    "${local.alz_root_id}-platform-management" = {
      display_name               = "${upper(local.alz_root_name)} Platform Management"
      parent_management_group_id = "${local.alz_root_id}-platform"
      subscription_ids           = []
      archetype_config = {
        archetype_id   = "es_management"
        parameters     = {}
        access_control = {}
      }
    }
    "${local.alz_root_id}-landingzones" = {
      display_name               = "${upper(local.alz_root_name)} Landing Zones"
      parent_management_group_id = local.alz_root_id
      subscription_ids           = []
      archetype_config = {
        archetype_id = "es_landing_zones"
        parameters = {}
        access_control = {}
      }
    }
  }
}

It looks like the policy definitions are created on the management groups and will give an error when trying to use of the archetype without the associated management group. Is it possible to create all the policy and policy set definitions on the root management group that gets created?

Azure / terraform-azurerm-caf-enterprise-scale