How to enable remediation for only certain policies in a custom initiative while still enabling the compliance report for all policies.

[raghuvanshir]

Thanks for the amazing module. I would like to report on non-complaince for all the policies in an initiative but would like the ability to create/recreate remediation tasks only for a select few policies. I tried with the exemption module and exempted all but a few policies. This does exempt all others except the ones i want to remediate but then it also exempts them from compliance reporting.

This is what i am trying with the exemption module with skip_remedation set to false but did not work out.

module "exemption_configure_initiative" {
source = "..//modules/exemption"
name = "Eventhub Diagnostic Policy Exemption"
display_name = "Exempted as per requirements"
description = "Excludes subscription from all or specific Event hub diagnostic policies"
scope = format("/subscriptions/%s", var.initiative_assignment_resource_id)
policy_assignment_id = module.set_rg_configure_diag_initiative.id # ID of initiative assignment created above.

oo--- Only executing the module if there are any policies whose remediation is set to false which implies those policies need to be exempted via this exemption module.
count = length(local.policies_remediation_false) > 0 ? 1 : 0

oo-- Adding the policies for exemption where remediation is set to false hoping then that the rest should have a remedation run against them
member_definition_names = count.index == 0 ? local.policies_remediation_false : []
}

[gettek]

Hi @raghuvanshir, on the assignment module you can skip_remediation=true, then create a remediation task alognside the module resource, specifying the subset of references you wish to remediate:

locals {
  definition_reference_ids = [
    "foo",
    "bar"
  ]
}

resource "azurerm_subscription_policy_remediation" "rem" {
  for_each                       = toset(local.definition_reference_ids)
  name                           = lower("${each.key}-${formatdate("DD-MM-YYYY-hh:mm:ss", timestamp())}")
  subscription_id                = data.azurerm_client_config.current.subscription_id
  policy_assignment_id           = module.set_rg_configure_diag_initiative.id
  policy_definition_reference_id = each.key
  resource_discovery_mode        = "ReEvaluateCompliance"
}

Note: the set_assignment module has the definition_reference_ids output

[raghuvanshir]

wonderful why did I not think of that. thank you let me try it out.