Azure / Azure/azure-quickstart-templates
Unable to deploy policy set to resource group from an ARM template
- Dominant language
- Bicep
- Stars
- 14.9k
- Forks
- 16.2k
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 6
Description
### Issue Details
I've tried to deploy a policy set to a resource group through an ARM template but I receive the following error (I have replaced my subscription ID within the error with a placeholder value). I am able to deploy this policy set to the resource group through the Azure portal :
New-AzureRmDeployment : 13:28:23 - Resource Microsoft.Authorization/policyAssignments 'DeployAzuremonitorforVMs'
failed with message '{
"error": {
"code": "InvalidCreatePolicyAssignmentRequest",
"message": "The policy assignment 'DeployAzuremonitorforVMs' create request is invalid. Policy assignment scope
'/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/eitnctestrg1' must match the scope specified on
the Uri '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'."
}
}'
At C:\TestBed\Deploy.ps1:66 char:9
+ New-AzureRmDeployment @GovernanceDeployParams
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-AzureRmDeployment], Exception
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureDeploymentCmdlet
Below is an excerpt from the JSON file:
{
"type": "Microsoft.Authorization/policyAssignments",
"name": "DeployAzuremonitorforVMs",
"apiVersion": "2019-09-01",
"properties": {
"displayName": "Enable Azure Monitor for VMs",
"scope": "[concat(subscription().id, '/resourceGroups/', parameters('rgName'))]",
"policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/55f3eceb-5573-4f18-9695-226972c6d74a",
"parameters": {
"logAnalytics_1": {
"value": "[concat(subscription().id, '/resourceGroups/EITOMSRG/providers/Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
}
}
},
"location": "[parameters('rgLocation')]",
"identity": {
"type": "SystemAssigned"
}
}
Thanks in advance for any assistance provided
Contributor guide
No contributing guide indexed for this repository
Research direction
Review the ARM JSON policyAssignments excerpt alongside C:\TestBed\Deploy.ps1 at line 66, starting with the reported mismatch between the assignment scope and deployment URI. Re-run New-AzureRmDeployment and confirm that the policy set can be deployed to the resource group without the InvalidCreatePolicyAssignmentRequest error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authorization, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100