Forum Discussion
Exempt - Azure CSPM Recommendation
We are implementing creating exemptions on policies through Terraform.
Is there a way to exempt this specific Azure CSPM standard policy "Restricted network access should be configured on Internet exposed Function app" through Terraform since it does not have any policyassignmentid and policyid.
I think this standard policy cannot be exempted with this code. Please confirm.
My understanding is this is Assessment type and has no policy id or policy assessment id. I can exempt through Azure Portal but not from Terraform.
Any guidance is greatly appreciated.
resource "azurerm_subscription_policy_exemption" "this" {
for_each = local.subscription_exemptions
name = each.key
subscription_id = each.value.resource_id
policy_assignment_id = each.value.policy_assignment_id
policy_definition_reference_ids = each.value.policy_definition_reference_ids
exemption_category = each.value.category
expires_on = each.value.expires_on
description = "Ticket: ${each.value.ticket} | ${each.value.remediation_plan}"
metadata = jsonencode(merge(var.tags, {
owner = each.value.owner
ticket = each.value.ticket
risk_level = each.value.risk_level
remediation_plan = each.value.remediation_plan
approved_by = each.value.approved_by
approval_date = each.value.approval_date
environment = var.environment
managed_by = "terraform"
}))
}
Thanks,
Anshu