[AVM Question/Feedback]: Should there be a way to merge default assignments?

[JWilkinsonMB]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Description

Are there any thoughts around supporting one or both of:

1. Allowing polices / assignments defined in the root library to be replaced with custom versions with the same name
2. Allowing default assignments to be merged, e.g. where a default such as the log analytics workspace is defined in the root library, but there is a custom policy assignment that should use the same value.

As an example, I currently need to use a custom version of the policy assignment Deploy-MDFC-Config-H224 & the policy set Deploy-MDFC-Config_20240319. The reason for this is that this policy set as provided will only deploy Defender for servers P2, whereas I want to deploy P1, so I've made this configurable.

The long term fix would be to try and get the ALZ policy updated so that it supports this ability, but that could take a while. In the meantime:

Without 1. I have to update any archetypes where this policy is used and override them to remove the version that's included in the library, and add my version which has to have a different name.

Without 2. I have to create a new default with a different name but the same value as the original because otherwise I get an error about the default already existing. This requires changes to the terraform code as well as the library files.

I understand that implementing 1. could lead to the risk of inadvertently overwriting a policy and risk causing more problems than the potential convenience is worth, so if that was the design decision behind removing the overwrite support (which used to exist in v0.13 of the provider with lib_overwrite_enabled) then I can get behind that. It would be good to have that discussion though and if it's possible / sensible to make it configurable as it used to be so the user can make that judgment call.

I think 2. could be supported safely as policy_assignments can be merged.

Technically I believe the implementation is in alzlib but thought the question better belongs here as it's more of a design decision than implementation. Happy to move it over there if that's preferred though.

Thanks!

[matt-FFFFFF]

Hi!

Thanks for the question. It should still possible to overwrite library artefacts, though we changed the attribute name to fit in with the move to go-getter refs.

Let me know if this option doesn't work for you...

https://registry.terraform.io/providers/Azure/alz/latest/docs#library_overwrite_enabled

[matt-FFFFFF]

#RR

[JWilkinsonMB]

Thanks @matt-FFFFFF, not sure how I missed that!

library_overwrite_enabled answers the 1st ask. However, if you set a default with the same name it overwrites it entirely rather than merging it, so it doesn't cover the 2nd point.

Particularly with the log analytics workspace I could see it being useful to be able to re-use the same default for custom policy assignments, although not a big deal, there's an easy workaround by creating an additional default.

[matt-FFFFFF]

I think merging defaults is one for a future release. For now you can clone them and add your own in another library reference.

I'll add the feature request to this