feat: add policy exemption to overwrites

locals.policy_exemption.tf

@@ -0,0 +1,40 @@
+locals {
+  policy_mitigated = flatten([
+    for k, v in local.azurerm_management_group_policy_assignment_enterprise_scale : [
+      for overwrite in
+      lookup(lookup(lookup(var.archetype_config_overrides, reverse(split("/", v.scope_id))[0], {}), "policy_exemption", {}), v.template.name, [])
+      : [
+        {
+          scope : v.template.properties.scope
+          policy_assignment_id : k
+          overwrite_id : overwrite
+          name : v.template.name
+          metadata = try(length(v.template.properties.metadata) > 0, false) ? jsonencode(v.template.properties.metadata) : null
+          is_subscription : length(regexall("/subscriptions/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/?$", overwrite)) > 0
+          is_resource_group : length(regexall("/subscriptions/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/resourceGroups/[^/]*/?$", overwrite)) > 0
+        }
+      ]
+    ]
+    ]
+  )
+  initiative_mitigated = flatten([
+    for k, v in local.azurerm_management_group_policy_assignment_enterprise_scale : [
+      for overwrite_key, overwrite_value in
+      lookup(lookup(lookup(var.archetype_config_overrides, reverse(split("/", v.scope_id))[0], {}), "initiative_exemption", {}), v.template.name, []) : [
+        for overwrite in overwrite_value : [
+          {
+            scope : v.template.properties.scope
+            policy_assignment_id : k
+            overwrite_id : overwrite
+            name : v.template.name
+            metadata = try(length(v.template.properties.metadata) > 0, false) ? jsonencode(v.template.properties.metadata) : null
+            is_subscription : length(regexall("/subscriptions/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/?$", overwrite)) > 0
+            is_resource_group : length(regexall("/subscriptions/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/resourceGroups/[^/]*/?$", overwrite)) > 0
+            policy_definition_reference_ids : [overwrite_key]
+          }
+        ]
+      ]
+    ]
+    ]
+  )
+}

resources.policy_exemption.tf

@@ -0,0 +1,59 @@
+resource "azurerm_resource_group_policy_exemption" "policy_mitigated_by_overwrite" {
+  for_each             = { for idx, val in local.policy_mitigated : idx => val if val.is_resource_group }
+  name                 = "caf-mitigated-${each.key}-${each.value.name}"
+  resource_group_id    = each.value.overwrite_id
+  policy_assignment_id = each.value.policy_assignment_id
+  metadata             = each.value.metadata
+  exemption_category   = "Mitigated"
+}
+
+resource "azurerm_subscription_policy_exemption" "policy_mitigated_by_overwrite" {
+  for_each             = { for idx, val in local.policy_mitigated : idx => val if val.is_subscription }
+  name                 = "caf-mitigated-${each.key}-${each.value.name}"
+  subscription_id      = each.value.overwrite_id
+  policy_assignment_id = each.value.policy_assignment_id
+  metadata             = each.value.metadata
+  exemption_category   = "Mitigated"
+}
+
+# if it is neither a subscription nor a resource group, it must be a resource
+resource "azurerm_resource_policy_exemption" "policy_mitigated_by_overwrite" {
+  for_each             = { for idx, val in local.policy_mitigated : idx => val if !val.is_subscription && !val.is_resource_group }
+  name                 = "caf-mitigated-${each.key}-${each.value.name}"
+  resource_id          = each.value.overwrite_id
+  policy_assignment_id = each.value.policy_assignment_id
+  metadata             = each.value.metadata
+  exemption_category   = "Mitigated"
+}
+
+
+resource "azurerm_resource_group_policy_exemption" "initiative_mitigated_by_overwrite" {
+  for_each                        = { for idx, val in local.initiative_mitigated : idx => val if val.is_resource_group }
+  name                            = "caf-mitigated-${each.key}-${each.value.name}"
+  resource_group_id               = each.value.overwrite_id
+  policy_assignment_id            = each.value.policy_assignment_id
+  metadata                        = each.value.metadata
+  exemption_category              = "Mitigated"
+  policy_definition_reference_ids = each.value.policy_definition_reference_ids
+}
+
+resource "azurerm_subscription_policy_exemption" "initiative_mitigated_by_overwrite" {
+  for_each                        = { for idx, val in local.initiative_mitigated : idx => val if val.is_subscription }
+  name                            = "caf-mitigated-${each.key}-${each.value.name}"
+  subscription_id                 = each.value.overwrite_id
+  policy_assignment_id            = each.value.policy_assignment_id
+  metadata                        = each.value.metadata
+  exemption_category              = "Mitigated"
+  policy_definition_reference_ids = each.value.policy_definition_reference_ids
+}
+
+# if it is neither a subscription nor a resource group, it must be a resource
+resource "azurerm_resource_policy_exemption" "initiative_mitigated_by_overwrite" {
+  for_each                        = { for idx, val in local.initiative_mitigated : idx => val if !val.is_subscription && !val.is_resource_group }
+  name                            = "caf-mitigated-${each.key}-${each.value.name}"
+  resource_id                     = each.value.overwrite_id
+  policy_assignment_id            = each.value.policy_assignment_id
+  metadata                        = each.value.metadata
+  exemption_category              = "Mitigated"
+  policy_definition_reference_ids = each.value.policy_definition_reference_ids
+}