How to manage multiple policy assignments for the same policy/initiative

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Description

I am wondering what is the recommended way to manage policy assignments when they need different parameters depending on the MG that they are assigned to. For example, let's assume that I have the following files and content in my codebase:

main.tenant-hierarchy.tf
```
variable "location" {
type = string
default = "australiaeast"
}

locals {
subscription_id_dev_mon = "1234"
subscription_id_prod_mon = "5678"
}

provider "azurerm" {
features {}
}

provider "alz" {
library_references = [
{
custom_url = "${path.root}/lib/eb"
}
]
}
data "azurerm_client_config" "current" {}

module "lnz-alz" {
source = "Azure/avm-ptn-alz/azurerm"
version = "0.12.0"
architecture_name = "lnz"
parent_resource_id = data.azurerm_client_config.current.tenant_id
location = var.location
}

provider "azurerm" {
alias = "dev"
subscription_id = local.subscription_id_dev_mon
}

provider "azurerm" {
alias = "prod"
subscription_id = local.subscription_id_prod_mon
}

module "monitoring_dev" {
providers = {
azurerm = azurerm.dev
}
source = "Azure/avm-ptn-alz-management/azurerm"
version = "0.6.0"
location = var.location
resource_group_name = "rg-dev-monitoring"
resource_group_creation_enabled = true
automation_account_name = "aa-dev-monitoring"
log_analytics_workspace_name = "law-dev-monitoring"
log_analytics_workspace_sku = "PerGB2018"
log_analytics_solution_plans = []
data_collection_rules = {
change_tracking = {
name = "dcr-change-tracking-dev"
}
defender_sql = {
name = "dcr-defender-sql-dev"
}
vm_insights = {
name = "dcr-vm-insights-dev"
}
}
user_assigned_managed_identities = {
ama = {
name = "uami-ama-dev-monitoring"
}
}
}

module "monitoring_prod" {
providers = {
azurerm = azurerm.prod
}
source = "Azure/avm-ptn-alz-management/azurerm"
version = "0.6.0"
location = var.location
resource_group_name = "rg-prod-monitoring"
resource_group_creation_enabled = true
automation_account_name = "aa-prod-monitoring"
log_analytics_workspace_name = "law-prod-monitoring"
log_analytics_workspace_sku = "PerGB2018"
log_analytics_solution_plans = []
data_collection_rules = {
change_tracking = {
name = "dcr-change-tracking-prod"
}
defender_sql = {
name = "dcr-defender-sql-prod"
}
vm_insights = {
name = "dcr-vm-insights-prod"
}
}
user_assigned_managed_identities = {
ama = {
name = "uami-ama-prod-monitoring"
}
}
}
```
lib/eb/alz_library_metadata.json
```
{
"$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/library_metadata.json",
"name": "eb",
"display_name": "Custom library for Azure Monitoring",
"description": "This library allows overriding policies, archetypes, and management group architecture in the default ALZ library.",
"dependencies": [
{
"path": "platform/alz",
"ref": "2025.02.0"
}
]
}
```
lib/eb/archetype_overrides/root.alz_archetype_override.yaml
```
name: "root_override"
base_archetype: "root"
policy_assignments_to_add: []
policy_assignments_to_remove:
- "Deploy-MDFC-SqlAtp"
- "Enforce-ACSB"
policy_definitions_to_add: []
policy_definitions_to_remove: []
policy_set_definitions_to_add: []
policy_set_definitions_to_remove: []
role_definitions_to_add: []
role_definitions_to_remove: []
```
lib/eb/archetype_overrides/platform.alz_archetype_override.yaml
```
name: "platform_override"
base_archetype: "platform"
policy_assignments_to_add: []
policy_assignments_to_remove:
- "Deploy-VM-Monitoring"
policy_definitions_to_add: []
policy_definitions_to_remove: []
policy_set_definitions_to_add: []
policy_set_definitions_to_remove: []
role_definitions_to_add: []
role_definitions_to_remove: []
```
lib/eb/architecture_definitions/eb.alz_architecture_definition.yaml
```
name: eb
management_groups:
- id: pseudo_root
display_name: RootMG
exists: true
parent_id: null
archetypes:
- root_override
- id: dev-workloads
display_name: Dev Workloads
exists: true
parent_id: pseudo_root
archetypes:
- platform_override
- id: prod-workloads
display_name: Prod Workloads
exists: true
parent_id: pseudo_root
archetypes:
- platform_override
- id: management
display_name: Management
exists: false
parent_id: pseudo_root
archetypes:
- management
```

The default alz library has a policy assignment called "Deploy VM Monitoring". Let's assume that I have two different DCRs for dev and prod. I can use `policy_assignments_to_modify` and do something like this:
```
policy_assignments_to_modify = {
dev-workloads = {
policy_assignments = {
Deploy-VM-Monitoring = {
parameters = {
dcrResourceId = jsonencode({ value = vars.dcr-dev.id })
}
}
}
}
prod-workloads = {
policy_assignments = {
Deploy-VM-Monitoring = {
parameters = {
dcrResourceId = jsonencode({ value = vars.dcr-prod.id })
}
}
}
}
}
```
but when you have a large number of polices this becomes hard to manage (I do realize that using MGs for lifecycle envs is not CAF-aligned).

Is there a better way that doesn't involve making copies of the policy assignments in the custom library?