Working with Policy exemptions in Enterprise scale

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request


• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request


• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I have several use cases where I need to use Policy exemptions for a single policy that's part of a policy initiative, and as far as I can see that's not possible using CAF-ES module. It looks like it's not possible in AzureRM ( https://github.com/hashicorp/terraform-provider-azurerm/issues/9197 ) but I was hoping for a crafty way around the problem.

Describe the solution you'd like

I would like to be able to assign NIST/CIS/ISO27001 to a management group, use the Deny effect on a number of policies for a number of things that are important to me (for example "Storage accounts should restrict network access") and then add an Exemption for a Resource Group in one Subscription where I don't feel that this is important (or applicable).
The only way of doing this today use the CAF-ES module is to add an Exclusion of the entire NIST initiative for the resource group that can't have "Storage accounts should restrict network access", which feels a bit blunt.

I'm currently investigating if I could use an ARM template deployment in combination with the CAF-ES module, but this also feels like shoe horning a solution that will break sooner or later since it's hard to synchronise the lifecycle of the two. Since Terraform has a tendency to recreate policy assignments every now and then there's a risk of having many stale Exemptions when an assignments gets a new ID. It feels like the only proper solution is to add support to the AzureRM provider to create Exemptions, but I'm open for any good workarounds until that happens. This has got to be an issue for a lot of organisations using Enterprise Scale?

Besides using ARM deployments, the only workaround I see is to NOT use Deny effects in an Initiative (only Audit), and deploy separate assignments of each policy definition (not using Initiatives) to the Management group level with an Exclusion (NotScope) set the the Resource group where the policy shouldn't be applied. In my case there is a risk of running into the limit of number of allowed policy assignments per scope, so this doesn't feel like a good solution either (and I would lose the Expiration date functionality as well).

Additional context

Start with the CAF-ES module and the AzureRM provider limitation described in issue #545; no files or tests are named. Done means supporting an exemption for a single policy within an initiative at resource-group scope, with assignment lifecycle changes not leaving stale exemptions.

Written by the indexing model from the issue text.