Issue with deploying initiative with a modify policy and a specific role

[rbmiller12]

Great repo. I'm gearing up to push out all of our policy using these modules. Thanks.

I'm having an issue deploying the built-in "Inherit a tag from the resource group if missing" policy with a "Tag Contributor" role.
The issue is with the assignment of my custom initiative that contains this policy. I'm getting a "Missing required argument" with principal_id = local.assignment.identity[0].principal_id. Any advice is appreciated.

[gettek]

Hi @rbmiller12,

Thank you, great to hear these modules have helped your deployments!

Could you kindly add some of your code in question to help debug please?

[rbmiller12]

Sure -

data "azurerm_role_definition" "tag_contributor" {
  name = "Tag Contributor"
}


module "tag_governance_sandbox_initiative" {
  source                  = "gettek/policy-as-code/azurerm//modules/initiative"
  version                 = "2.7.2"
  initiative_name         = "tag_governance_sandbox_initiative"
  initiative_display_name = "Tag Governance Sandbox"
  initiative_description  = "Tag Governance Sandbox Policies"
  initiative_category     = "Tags"
  management_group_id     = data.azurerm_management_group.corp.id
  merge_effects           = false
  merge_parameters        = false

  # Populate member_definitions with a for loop (explicit)
  member_definitions = concat(
    [
    module.require_subscription_tag_with_pattern_match.definition
    data.azurerm_policy_definition.inherit_tag_from_subscription_if_missing
    ],
    [
      for tag in azurerm_policy_definition.require_subscription_tags :
      tag
    ]
  )
}


module "org_mg_tag_governance_sandbox_initiative" {
  source                  = "gettek/policy-as-code/azurerm//modules/set_assignment"
  version                 = "2.7.2"
  initiative              = module.tag_governance_sandbox_initiative.initiative
  assignment_scope        = data.azurerm_management_group.sandboxes.id
  skip_remediation        = true
  skip_role_assignment    = false
  resource_discovery_mode = local.resource_discovery_mode
  assignment_location     = "eastus2"

  role_definition_ids = [
    data.azurerm_role_definition.tag_contributor.id
  ]

  assignment_parameters = {
    TagName_RequireSubscriptionTagWithPatternMatch = "CostCenter"
    TagMatch_RequireSubscriptionTagWithPatternMatch = ".####"
    effect_RequireSubscriptionTagWithPatternMatch = "Deny"
    effect_RequireSubscriptionTagOwner            = "Deny"
    effect_RequireSubscriptionTagTechnicalcontact = "Deny"
    effect_RequireSubscriptionTagEnvironment      = "Deny"
    tagName_40df99da123249b1a39a6da8d878f469 = "CostCenter"         # inherit_tag_from_subscription_if_missing
    tagName_40df99da123249b1a39a6da8d878f469 = "Owner"              # inherit_tag_from_subscription_if_missing
    tagName_40df99da123249b1a39a6da8d878f469 = "TechnicalContact"   # inherit_tag_from_subscription_if_missing
    tagName_40df99da123249b1a39a6da8d878f469 = "Environment"        # inherit_tag_from_subscription_if_missing
  }
}

[gettek]

Hi @rbmiller12, the set_assignment looks correct so you should be seeing the azurerm_role_assignment resource be created during assignment, something like:

module.org_mg_tag_governance_sandbox_initiative.azurerm_role_assignment.rem_role["/providers/Microsoft.Authorization/roleDefinitions/4a9ae827-6dc8-4573-8ac7-8239d42aa03f"] will be created

The error appears related to the principal_id output but I'll need a little more information, can you please share the output from TF_LOG = DEBUG or ERROR ? Thanks