Feature Request - On/Off switch to control policy assignments

[cjtous1]

Feature Request - On/Off switch to control policy assignments

[praveenambati1233]

One way to exclude the policy assignments you can remove these lines from here https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/blob/main/modules/archetypes/lib/archetype_definitions/archetype_definition_es_identity.tmpl.json#L4-L7

[matt-FFFFFF]

Hi,

Is it just the assignments you want to remove, or all policy artefacts?

[cjtous1]

I would like to make sure no assignments are done. Right now, the way I am doing it is via archetype_exclusion_es_.tmpl.json files where I have to list every single policy assignments, policy definitions and policy set definitions to exclude.
If I understand things correctly, these will be defined in EPAC... correct?

What if you release new policies or deprecate some of them. I will have to keep updating those exclusions in the JSON file.
It would be simpler if we could have a global switch that disables any kind of policy work in this module so that I can be assured that only EPAC will deploy and manage policies.

[matt-FFFFFF]

If you want to exclude all policies then use archetype_config_overrides and set the archetype for the management groups to default_empty.

This will mean you only deploy the MG structure.

[cjtous1]

OK, I think this could work for us. However, it looks like I would miss out on custom role definitions and any kind of "archetype_config" that could be defined at a later time. Do you foresee any issues there?

[matt-FFFFFF]

It's only role defs, we don't plan on expanding archetype config beyond its current capabilities.