Auto-remediation of existing non compliant resources

[vinp007]

Hey everyone,

Gettek is a God send for Azure Policy :)

Just wondering if there a way to auto-remediate existing non compliant resources like tags & missing agents / extensions (for modify or DINE/ deployifnotexist conditions)?

Also, just thinking loud - Is it possible to perhaps utilise the on demand evaluation scan (https://github.com/gettek/terraform-azurerm-policy-as-code#%EF%B8%8Fon-demand-evaluation-scan) in some way to trigger a scheduled auto remediation?

Would be great if someone could share their experience / enlighten me in that direction :)
Thanks in advance for all the inputs.

Cheers

[gettek]

Hi @vinp007, I'm not sure what the ask is here?

As the docs suggest, setting re_evaluate_compliance=true will force the Policy engine to recheck your environment for non-compliance. Execute this with skip_remediation=true and once complete, you can rerun your workflow with both set to false in order to create remediation tasks. The Azure Policy engine regularly checks for non-compliance but explicitly demanding re-evaluation can grant granular control in your workflows.