diff --git a/azurerm/internal/services/policy/parse/definition.go b/azurerm/internal/services/policy/parse/definition.go index 2ca10d050b1a..fe88943aac67 100644 --- a/azurerm/internal/services/policy/parse/definition.go +++ b/azurerm/internal/services/policy/parse/definition.go @@ -12,8 +12,10 @@ type PolicyDefinitionId struct { // TODO: This parsing function is currently suppressing every case difference due to github issue: https://github.com/Azure/azure-rest-api-specs/issues/8353 func PolicyDefinitionID(input string) (*PolicyDefinitionId, error) { - // in general, the id of a definition should be: + // in general, the id of a definition should be (for custom policy definition): // {scope}/providers/Microsoft.Authorization/policyDefinitions/{name} + // and for built-in policy-definition: + // /providers/Microsoft.Authorization/policyDefinitions/{name} regex := regexp.MustCompile(`/providers/[Mm]icrosoft\.[Aa]uthorization/policy[Dd]efinitions/`) if !regex.MatchString(input) { return nil, fmt.Errorf("unable to parse Policy Definition ID %q", input) @@ -31,6 +33,12 @@ func PolicyDefinitionID(input string) (*PolicyDefinitionId, error) { return nil, fmt.Errorf("unable to parse Policy Definition ID %q: definition name is empty", input) } + if scope == "" { + return &PolicyDefinitionId{ + Name: name, + }, nil + } + scopeId, err := PolicyScopeID(scope) if err != nil { return nil, fmt.Errorf("unable to parse Policy Definition ID %q: %+v", input, err) diff --git a/azurerm/internal/services/policy/parse/definition_test.go b/azurerm/internal/services/policy/parse/definition_test.go index c48d4757b925..7e70f36fe59f 100644 --- a/azurerm/internal/services/policy/parse/definition_test.go +++ b/azurerm/internal/services/policy/parse/definition_test.go @@ -17,6 +17,13 @@ func TestValidatePolicyDefinitionID(t *testing.T) { Input: "", Error: true, }, + { + Name: "built-in policy definition ID", + Input: "/providers/Microsoft.Authorization/policyDefinitions/00000000-0000-0000-0000-000000000000", + Expected: &PolicyDefinitionId{ + Name: "00000000-0000-0000-0000-000000000000", + }, + }, { Name: "regular policy definition", Input: "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/policyDefinitions/def1", diff --git a/azurerm/internal/services/policy/tests/resource_arm_policy_assignment_test.go b/azurerm/internal/services/policy/tests/resource_arm_policy_assignment_test.go index 83ab2d9ba8f2..69ce4dc9e21e 100644 --- a/azurerm/internal/services/policy/tests/resource_arm_policy_assignment_test.go +++ b/azurerm/internal/services/policy/tests/resource_arm_policy_assignment_test.go @@ -12,7 +12,7 @@ import ( "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/features" ) -func TestAccAzureRMPolicyAssignment_basic(t *testing.T) { +func TestAccAzureRMPolicyAssignment_basicCustom(t *testing.T) { data := acceptance.BuildTestData(t, "azurerm_policy_assignment", "test") resource.ParallelTest(t, resource.TestCase{ PreCheck: func() { acceptance.PreCheck(t) }, @@ -20,7 +20,25 @@ func TestAccAzureRMPolicyAssignment_basic(t *testing.T) { CheckDestroy: testCheckAzureRMPolicyAssignmentDestroy, Steps: []resource.TestStep{ { - Config: testAzureRMPolicyAssignment_basic(data), + Config: testAzureRMPolicyAssignment_basicCustom(data), + Check: resource.ComposeTestCheckFunc( + testCheckAzureRMPolicyAssignmentExists(data.ResourceName), + ), + }, + data.ImportStep(), + }, + }) +} + +func TestAccAzureRMPolicyAssignment_basicBuiltin(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_policy_assignment", "test") + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acceptance.PreCheck(t) }, + Providers: acceptance.SupportedProviders, + CheckDestroy: testCheckAzureRMPolicyAssignmentDestroy, + Steps: []resource.TestStep{ + { + Config: testAzureRMPolicyAssignment_basicBuiltin(data), Check: resource.ComposeTestCheckFunc( testCheckAzureRMPolicyAssignmentExists(data.ResourceName), ), @@ -43,7 +61,7 @@ func TestAccAzureRMPolicyAssignment_requiresImport(t *testing.T) { CheckDestroy: testCheckAzureRMPolicyAssignmentDestroy, Steps: []resource.TestStep{ { - Config: testAzureRMPolicyAssignment_basic(data), + Config: testAzureRMPolicyAssignment_basicCustom(data), Check: resource.ComposeTestCheckFunc( testCheckAzureRMPolicyAssignmentExists(data.ResourceName), ), @@ -155,24 +173,24 @@ func testCheckAzureRMPolicyAssignmentDestroy(s *terraform.State) error { return nil } -func testAzureRMPolicyAssignment_basic(data acceptance.TestData) string { +func testAzureRMPolicyAssignment_basicCustom(data acceptance.TestData) string { return fmt.Sprintf(` provider "azurerm" { features {} } resource "azurerm_policy_definition" "test" { - name = "acctestpol-%d" + name = "acctestpol-%[1]d" policy_type = "Custom" mode = "All" - display_name = "acctestpol-%d" + display_name = "acctestpol-%[1]d" policy_rule = <