Azure / Azure/azure-quickstart-templates

Unable to deploy policy set to resource group from an ARM template

Open
#7,535 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Bicep
Stars
14.9k
Forks
16.2k
Avg merge
6d 21h
Merged PRs (30d)
6

Description

### Issue Details
I've tried to deploy a policy set to a resource group through an ARM template but I receive the following error (I have replaced my subscription ID within the error with a placeholder value). I am able to deploy this policy set to the resource group through the Azure portal :

New-AzureRmDeployment : 13:28:23 - Resource Microsoft.Authorization/policyAssignments 'DeployAzuremonitorforVMs'
failed with message '{
"error": {
"code": "InvalidCreatePolicyAssignmentRequest",
"message": "The policy assignment 'DeployAzuremonitorforVMs' create request is invalid. Policy assignment scope
'/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/eitnctestrg1' must match the scope specified on
the Uri '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'."
}
}'
At C:\TestBed\Deploy.ps1:66 char:9
+ New-AzureRmDeployment @GovernanceDeployParams
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-AzureRmDeployment], Exception
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureDeploymentCmdlet

Below is an excerpt from the JSON file:

{
"type": "Microsoft.Authorization/policyAssignments",
"name": "DeployAzuremonitorforVMs",
"apiVersion": "2019-09-01",
"properties": {
"displayName": "Enable Azure Monitor for VMs",
"scope": "[concat(subscription().id, '/resourceGroups/', parameters('rgName'))]",
"policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/55f3eceb-5573-4f18-9695-226972c6d74a",
"parameters": {
"logAnalytics_1": {
"value": "[concat(subscription().id, '/resourceGroups/EITOMSRG/providers/Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
}
}
},
"location": "[parameters('rgLocation')]",
"identity": {
"type": "SystemAssigned"
}
}

Thanks in advance for any assistance provided

Contributor guide

No contributing guide indexed for this repository

Research direction

Review the ARM JSON policyAssignments excerpt alongside C:\TestBed\Deploy.ps1 at line 66, starting with the reported mismatch between the assignment scope and deployment URI. Re-run New-AzureRmDeployment and confirm that the policy set can be deployed to the resource group without the InvalidCreatePolicyAssignmentRequest error.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.