Forum Discussion

ABhatia610's avatar
ABhatia610
Copper Contributor
Jun 16, 2026

Exempt - Azure CSPM Recommendation

We are implementing creating exemptions on policies through Terraform.

Is there a way to exempt this specific Azure CSPM standard policy "Restricted network access should be configured on Internet exposed Function app" through Terraform since it does not have any policyassignmentid and policyid.

I think this standard policy cannot be exempted with this code. Please confirm. 

My understanding is this is Assessment type and has no policy id or policy assessment id. I can exempt through Azure Portal but not from Terraform. 

Any guidance is greatly appreciated.

resource "azurerm_subscription_policy_exemption" "this" {

for_each = local.subscription_exemptions

 

name = each.key

subscription_id = each.value.resource_id

policy_assignment_id = each.value.policy_assignment_id

policy_definition_reference_ids = each.value.policy_definition_reference_ids

exemption_category = each.value.category

expires_on = each.value.expires_on

description = "Ticket: ${each.value.ticket} | ${each.value.remediation_plan}"

 

metadata = jsonencode(merge(var.tags, {

owner = each.value.owner

ticket = each.value.ticket

risk_level = each.value.risk_level

remediation_plan = each.value.remediation_plan

approved_by = each.value.approved_by

approval_date = each.value.approval_date

environment = var.environment

managed_by = "terraform"

}))

}

Thanks,

Anshu

No RepliesBe the first to reply