Terraform-provider-azurerm: `azurerm_policy_set_definition` reports error during update

[ArcturusZhang]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

terraform 0.12.29

Affected Resource(s)

• azurerm_policy_set_definition

Terraform Configuration Files

provider "azurerm" {
  # whilst the `version` attribute is optional, we recommend pinning to a given version of the Provider
  version = ">=2.31.0"
  features {}
}
data "azurerm_policy_definition" "activity_log_exist_admin_operations" {
  display_name = "An activity log alert should exist for specific Administrative operations"
}
resource "azurerm_policy_set_definition" "cis_custom" {
  name                  = "CIS Custom Effects"
  policy_type           = "Custom"
  display_name          = "CIS Custom Effects"
  policy_definition_reference {
    policy_definition_id = data.azurerm_policy_definition.activity_log_exist_admin_operations.id
    parameter_values = jsonencode({
      operationName = { value = "Microsoft.Sql/servers/firewallRules/delete" }
    })
  }
}

Debug Output

Panic Output

Expected Behavior

The policy set definition could be updated successfully

Actual Behavior

An error occurs:

Error: expanding `policy_definition_reference`: cannot set both `parameters` and `parameter_values`

Steps to Reproduce

1. terraform apply with the config above
2. change the display name and terraform apply again

Important Factoids

References

• #0000

[gettek]

Also Related

parameter_values now expects a string but should be an object map:

Inappropriate value for attribute "parameter_values": string required.

[ArcturusZhang]

Also Related

parameter_values now expects a string but should be an object map:

Inappropriate value for attribute "parameter_values": string required.

Actually parameters is an object map (and deprecated), parameter_values is a JSON string with the same format as the parameters in azurerm_policy_assignment.

Please note the jsonencode function in the config I posted in the description.

[gettek]

Also Related

parameter_values now expects a string but should be an object map:
Inappropriate value for attribute "parameter_values": string required.

Actually parameters is an object map (and deprecated), parameter_values is a JSON string with the same format as the parameters in azurerm_policy_assignment.

Please note the jsonencode function in the config I posted in the description.

The docs should be updated to avoid confusion:
parameter_values - (Optional) Parameter values for the referenced policy rule. This field is a json object that allows you to assign parameters to this policy rule.

[ArcturusZhang]

Hi @gettek I also include the doc update in my fix for this issue.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!