Merge pull request #21 from krowlandson/main

Adding Role Assignments for Policies
Azure · Nov 27, 2020 · fe4ad5b · fe4ad5b
2 parents 6bab697 + 5693603
commit fe4ad5b
Show file tree

Hide file tree

Showing 144 changed files with 308 additions and 91 deletions.
diff --git a/README.md b/README.md
@@ -37,6 +37,8 @@ To use this module with all default settings, please include the following in yo
 > 2. This module has a single mandatory variable `root_parent_id` which is used to set the parent ID to use as the root for deployment. All other variables are optional but can be used to customise your deployment.
 >
 > 3. If using the `azurerm_subscription` data source to provide a `tenant_id` value from the current context for `root_parent_id`, you are likely to get a warning that Terraform cannot determine the number of resources to create during the `plan` stage. To avoid the need to use `terraform apply -target=resource` or putting such values in source code, we recommend providing the `root_parent_id` value explicitly via the command-line using `-var 'root_parent_id={{ tenant_id }}'` or your preferred method of injecting variable values at runtime.
+>
+> 4. As of version `0.0.8` this module now supports the creation of Role Assignments for any valid Policy Assignment deployed using the module. This feature enumerates the appropriate role(s) needed by the assigned Policy Definition or Policy Set Definition and creates the necessary Role Assignments for the auto-generated Managed Identity at the same scope as the Policy Assignment. This capability provides feature parity with the Azure Portal experience when creating Policy Assignments using the `DeployIfNotExists` or `Modify` effects. If the Policy Assignment needs to interact with resources not under the same scope as the Policy Assignment, you will need to create additional Role Assignments at the appropriate scope.
 
 ### Simple Example
 
@@ -53,7 +55,7 @@ variable "tenant_id" {
 
 module "enterprise_scale" {
   source  = "Azure/caf-enterprise-scale/azurerm"
-  version = "0.0.7-preview"
+  version = "0.0.8"
 
   root_parent_id = var.tenant_id
 
@@ -77,7 +79,7 @@ variable "tenant_id" {
 
 module "enterprise_scale" {
   source  = "Azure/caf-enterprise-scale/azurerm"
-  version = "0.0.7-preview"
+  version = "0.0.8"
 
   # Mandatory Variables
   root_parent_id            = var.tenant_id

diff --git a/locals.policy_assignments.tf b/locals.policy_assignments.tf
@@ -20,3 +20,190 @@ locals {
     assignment.resource_id => assignment
   }
 }
+
+# To support the creation of Role Assignments for Policy Assignments
+# using a Managed Identity, we need to identify the associated
+# Role Definition(s) relating to the assigned Policy [Set] Definition
+# within each Policy Assignment. This requires the following logic
+# to determine which Role Assignments to create.
+
+# Generate a list of internal Policy Definitions and Policy
+# Set Definitions.
+locals {
+  internal_policy_definition_ids = [
+    for policy_definition in local.es_policy_definitions :
+    policy_definition.resource_id
+  ]
+  internal_policy_set_definition_ids = [
+    for policy_set_definition in local.es_policy_set_definitions :
+    policy_set_definition.resource_id
+  ]
+}
+
+# Determine which Policy Assignments use a Managed Identity.
+locals {
+  policy_assignments_with_managed_identity = {
+    for assignment in local.es_policy_assignments :
+    assignment.resource_id => assignment.template.properties.policyDefinitionId
+    if assignment.template.identity.type == "SystemAssigned"
+  }
+}
+
+# Determine which of these Policy Assignments assign a Policy
+# Definition or Policy Set Definition which is either built-in,
+# or deployed to Azure using a process outside of this module.
+locals {
+  # Policy Definitions
+  policy_assignments_with_managed_identity_using_external_policy_definition = {
+    for policy_assignment_id, policy_definition_id in local.policy_assignments_with_managed_identity :
+    policy_assignment_id => policy_definition_id
+    if length(regexall(local.resource_types.policy_definition, policy_definition_id)) > 0 && contains(local.internal_policy_definition_ids, policy_definition_id) != true
+  }
+  # Policy Set Definitions
+  policy_assignments_with_managed_identity_using_external_policy_set_definition = {
+    for policy_assignment_id, policy_set_definition_id in local.policy_assignments_with_managed_identity :
+    policy_assignment_id => policy_set_definition_id
+    if length(regexall(local.resource_types.policy_set_definition, policy_set_definition_id)) > 0 && contains(local.internal_policy_set_definition_ids, policy_set_definition_id) != true
+  }
+}
+
+# Generate list of Policy Set Definitions to lookup from Azure.
+locals {
+  azurerm_policy_set_definition_external_lookup = {
+    for policy_set_definition_id in local.policy_assignments_with_managed_identity_using_external_policy_set_definition :
+    policy_set_definition_id => {
+      name                  = basename(policy_set_definition_id)
+      management_group_name = try(regex(local.regex_extract_provider_scope, policy_set_definition_id), null)
+    }
+  }
+}
+
+# Perform a lookup of the Policy Set Definitions not deployed by this module.
+data "azurerm_policy_set_definition" "external_lookup" {
+  for_each = local.azurerm_policy_set_definition_external_lookup
+
+  name                  = each.value.name
+  management_group_name = each.value.management_group_name
+}
+
+# Create a list of Policy Definitions IDs used by all assigned Policy Set Definitions
+locals {
+  policy_definitions_ids_from_internal_policy_set_definitions = {
+    for policy_set_definition in local.es_policy_set_definitions :
+    policy_set_definition.resource_id => try(policy_set_definition.template.policyDefinitions.*.policyDefinitionId, local.empty_list)
+  }
+  policy_definitions_ids_from_external_policy_set_definitions = {
+    for policy_set_definition_id, policy_set_definition_config in data.azurerm_policy_set_definition.external_lookup :
+    policy_set_definition_id => [
+      for policy_definition_reference in policy_set_definition_config.policy_definition_reference :
+      policy_definition_reference.policy_definition_id
+    ]
+  }
+  policy_definitions_ids_from_policy_set_definitions = merge(
+    local.policy_definitions_ids_from_internal_policy_set_definitions,
+    local.policy_definitions_ids_from_external_policy_set_definitions,
+  )
+}
+
+# Identify all Policy Definitions which are external to this module
+locals {
+  # From Policy Assignments using Policy Set Definitions
+  external_policy_definitions_ids_from_policy_set_definitions = distinct(flatten([
+    for policy_definitions in values(local.policy_definitions_ids_from_policy_set_definitions) : [
+      for policy_definition in policy_definitions :
+      policy_definition
+      if contains(local.internal_policy_definition_ids, policy_definition) != true
+    ]
+  ]))
+  external_policy_definitions_from_azurerm_policy_set_definition_external_lookup = {
+    for policy_set_definition_id in local.external_policy_definitions_ids_from_policy_set_definitions :
+    policy_set_definition_id => {
+      name                  = basename(policy_set_definition_id)
+      management_group_name = try(regex(local.regex_extract_provider_scope, policy_set_definition_id), null)
+    }
+  }
+  # From Policy Assignments using Policy Definitions
+  external_policy_definitions_from_internal_policy_assignments = {
+    for policy_set_definition_id in local.policy_assignments_with_managed_identity_using_external_policy_definition :
+    policy_set_definition_id => {
+      name                  = basename(policy_set_definition_id)
+      management_group_name = try(regex(local.regex_extract_provider_scope, policy_set_definition_id), null)
+    }
+  }
+  # Then create a single list containing all Policy Definitions to lookup from Azure
+  azurerm_policy_definition_external_lookup = merge(
+    local.external_policy_definitions_from_azurerm_policy_set_definition_external_lookup,
+    local.external_policy_definitions_from_internal_policy_assignments,
+  )
+}
+
+# Perform a lookup of the Policy Definitions not deployed by this module.
+data "azurerm_policy_definition" "external_lookup" {
+  for_each = local.azurerm_policy_definition_external_lookup
+
+  name                  = each.value.name
+  management_group_name = each.value.management_group_name
+}
+
+# Extract the Role Definition IDs from the internal and external
+# Policy Definitions, then combine into a single lookup map.
+locals {
+  internal_policy_definition_roles = {
+    for policy_definition in local.es_policy_definitions :
+    policy_definition.resource_id => try(policy_definition.template.policyRule.then.details.roleDefinitionIds, local.empty_list)
+  }
+  external_policy_definition_roles = {
+    for policy_definition_id, policy_definition_config in data.azurerm_policy_definition.external_lookup :
+    policy_definition_id => try(jsondecode(policy_definition_config.policy_rule).then.details.roleDefinitionIds, local.empty_list)
+  }
+  policy_definition_roles = merge(
+    local.internal_policy_definition_roles,
+    local.external_policy_definition_roles,
+  )
+}
+
+# Merge the map of Policy Definitions from internal and
+# external Policy Set Definitions then generate the map
+# of roles for each.
+locals {
+  policy_set_definition_roles = {
+    for policy_set_definition_id, policy_definition_ids in local.policy_definitions_ids_from_policy_set_definitions :
+    policy_set_definition_id => distinct(flatten([
+      for policy_definition_id in policy_definition_ids :
+      local.policy_definition_roles[policy_definition_id]
+    ]))
+  }
+}
+
+# Merge the map of roles for Policy Definitions and
+# Policy Set Definitions.
+locals {
+  policy_roles = merge(
+    local.policy_definition_roles,
+    local.policy_set_definition_roles,
+  )
+}
+
+# Construct the array used to determine the list of
+# Role Assignments to create for the Managed Identities
+# used by Policy Assignments.
+# The "identity" object is an array containing a single
+# identity item.
+# The try() logic below is to prevent errors when running
+# 'terraform destroy'.
+locals {
+  es_role_assignments_by_policy_assignment = flatten([
+    for policy_assignment_id, policy_id in local.policy_assignments_with_managed_identity : [
+      for role_definition_id in try(local.policy_roles[policy_id], local.empty_list) : [
+        {
+          resource_id                      = "${local.azurerm_policy_assignment_enterprise_scale[policy_assignment_id].scope_id}${local.provider_path.role_assignment}${uuidv5(uuidv5("url", role_definition_id), policy_assignment_id)}"
+          scope_id                         = local.azurerm_policy_assignment_enterprise_scale[policy_assignment_id].scope_id
+          principal_id                     = try(azurerm_policy_assignment.enterprise_scale[policy_assignment_id].identity[0].principal_id, null)
+          role_definition_name             = null
+          role_definition_id               = role_definition_id
+          skip_service_principal_aad_check = true
+        }
+      ]
+    ]
+  ])
+}
diff --git a/locals.role_assignments.tf b/locals.role_assignments.tf
@@ -9,6 +9,7 @@ locals {
   es_role_assignments = concat(
     local.es_role_assignments_by_management_group,
     local.es_role_assignments_by_subscription,
+    local.es_role_assignments_by_policy_assignment,
   )
 }
 

diff --git a/locals.tf b/locals.tf
@@ -23,9 +23,21 @@ locals {
 }
 
 # The following locals are used to define base Azure
-# provider paths
+# provider paths and resource types
 locals {
   provider_path = {
     management_groups = "/providers/Microsoft.Management/managementGroups/"
+    role_assignment   = "/providers/Microsoft.Authorization/roleAssignments/"
   }
+  resource_types = {
+    policy_definition     = "Microsoft.Authorization/policyDefinitions"
+    policy_set_definition = "Microsoft.Authorization/policySetDefinitions"
+  }
+}
+
+# The following locals are used to define RegEx
+# patterns used within this module
+
+locals {
+  regex_extract_provider_scope = "(?i)/(?=.*/providers/)[^/]+/[\\S]+(?=.*/providers/)"
 }
diff --git a/main.tf b/main.tf
@@ -6,7 +6,7 @@
 # groups of Resources within a Subscription.
 module "management_group_archetypes" {
   for_each = local.es_landing_zones_map
-  source   = "./modules/terraform-azurerm-caf-enterprise-scale-archetypes"
+  source   = "./modules/archetypes"
 
   root_id                 = "${local.provider_path.management_groups}${local.root_id}"
   scope_id                = each.key

diff --git a/...b/archetype_definition_default_empty.json → ...s/archetype_definition_default_empty.json b/...b/archetype_definition_default_empty.json → ...s/archetype_definition_default_empty.json
diff --git a/...tion_es_connectivity_foundation.tmpl.json → ...tion_es_connectivity_foundation.tmpl.json b/...tion_es_connectivity_foundation.tmpl.json → ...tion_es_connectivity_foundation.tmpl.json
diff --git a/...n_es_connectivity_hub_and_spoke.tmpl.json → ...n_es_connectivity_hub_and_spoke.tmpl.json b/...n_es_connectivity_hub_and_spoke.tmpl.json → ...n_es_connectivity_hub_and_spoke.tmpl.json
diff --git a/...definition_es_connectivity_vwan.tmpl.json → ...definition_es_connectivity_vwan.tmpl.json b/...definition_es_connectivity_vwan.tmpl.json → ...definition_es_connectivity_vwan.tmpl.json
diff --git a/...pe_definition_es_decommissioned.tmpl.json → ...pe_definition_es_decommissioned.tmpl.json b/...pe_definition_es_decommissioned.tmpl.json → ...pe_definition_es_decommissioned.tmpl.json
diff --git a/...chetype_definition_es_demo_corp.tmpl.json → ...chetype_definition_es_demo_corp.tmpl.json b/...chetype_definition_es_demo_corp.tmpl.json → ...chetype_definition_es_demo_corp.tmpl.json
diff --git a/...etype_definition_es_demo_online.tmpl.json → ...etype_definition_es_demo_online.tmpl.json b/...etype_definition_es_demo_online.tmpl.json → ...etype_definition_es_demo_online.tmpl.json
diff --git a/...rchetype_definition_es_demo_sap.tmpl.json → ...rchetype_definition_es_demo_sap.tmpl.json b/...rchetype_definition_es_demo_sap.tmpl.json → ...rchetype_definition_es_demo_sap.tmpl.json
diff --git a/...rchetype_definition_es_identity.tmpl.json → ...rchetype_definition_es_identity.tmpl.json b/...rchetype_definition_es_identity.tmpl.json → ...rchetype_definition_es_identity.tmpl.json
diff --git a/...ype_definition_es_landing_zones.tmpl.json → ...ype_definition_es_landing_zones.tmpl.json b/...ype_definition_es_landing_zones.tmpl.json → ...ype_definition_es_landing_zones.tmpl.json
diff --git a/...hetype_definition_es_management.tmpl.json → ...hetype_definition_es_management.tmpl.json b/...hetype_definition_es_management.tmpl.json → ...hetype_definition_es_management.tmpl.json
diff --git a/...rchetype_definition_es_platform.tmpl.json → ...rchetype_definition_es_platform.tmpl.json b/...rchetype_definition_es_platform.tmpl.json → ...rchetype_definition_es_platform.tmpl.json
diff --git a/...ib/archetype_definition_es_root.tmpl.json → ...ns/archetype_definition_es_root.tmpl.json b/...ib/archetype_definition_es_root.tmpl.json → ...ns/archetype_definition_es_root.tmpl.json
@@ -97,7 +97,7 @@
             "ES-Deploy-Sql-AuditingSettings",
             "ES-Deploy-Sql-SecurityAlertPolicies",
             "ES-Deploy-Sql-Tde",
-            "ES-Deploy-Sql-vulnerabilityAssessments",
+            "ES-Deploy-Sql-VulnerabilityAssessments",
             "ES-Deploy-vHUB",
             "ES-Deploy-vNet",
             "ES-Deploy-vWAN",

diff --git a/...chetype_definition_es_sandboxes.tmpl.json → ...chetype_definition_es_sandboxes.tmpl.json b/...chetype_definition_es_sandboxes.tmpl.json → ...chetype_definition_es_sandboxes.tmpl.json
diff --git a/...t_es_allowed_resource-locations.tmpl.json → ...t_es_allowed_resource-locations.tmpl.json b/...t_es_allowed_resource-locations.tmpl.json → ...t_es_allowed_resource-locations.tmpl.json
diff --git a/...allowed_resourcegroup-locations.tmpl.json → ...allowed_resourcegroup-locations.tmpl.json b/...allowed_resourcegroup-locations.tmpl.json → ...allowed_resourcegroup-locations.tmpl.json
diff --git a/...nment_es_deny_appgw_without_waf.tmpl.json → ...nment_es_deny_appgw_without_waf.tmpl.json b/...nment_es_deny_appgw_without_waf.tmpl.json → ...nment_es_deny_appgw_without_waf.tmpl.json
diff --git a/...ssignment_es_deny_ip_forwarding.tmpl.json → ...ssignment_es_deny_ip_forwarding.tmpl.json b/...ssignment_es_deny_ip_forwarding.tmpl.json → ...ssignment_es_deny_ip_forwarding.tmpl.json
diff --git a/...nment_es_deny_rdp_from_internet.tmpl.json → ...nment_es_deny_rdp_from_internet.tmpl.json b/...nment_es_deny_rdp_from_internet.tmpl.json → ...nment_es_deny_rdp_from_internet.tmpl.json
diff --git a/...cy_assignment_es_deny_resources.tmpl.json → ...cy_assignment_es_deny_resources.tmpl.json b/...cy_assignment_es_deny_resources.tmpl.json → ...cy_assignment_es_deny_resources.tmpl.json
diff --git a/...ment_es_deny_subnet_without_nsg.tmpl.json → ...ment_es_deny_subnet_without_nsg.tmpl.json b/...ment_es_deny_subnet_without_nsg.tmpl.json → ...ment_es_deny_subnet_without_nsg.tmpl.json
diff --git a/...icy_assignment_es_deploy_asc_ce.tmpl.json → ...icy_assignment_es_deploy_asc_ce.tmpl.json b/...icy_assignment_es_deploy_asc_ce.tmpl.json → ...icy_assignment_es_deploy_asc_ce.tmpl.json
diff --git a/...gnment_es_deploy_asc_monitoring.tmpl.json → ...gnment_es_deploy_asc_monitoring.tmpl.json b/...gnment_es_deploy_asc_monitoring.tmpl.json → ...gnment_es_deploy_asc_monitoring.tmpl.json
diff --git a/...signment_es_deploy_asc_standard.tmpl.json → ...signment_es_deploy_asc_standard.tmpl.json b/...signment_es_deploy_asc_standard.tmpl.json → ...signment_es_deploy_asc_standard.tmpl.json
diff --git a/...ment_es_deploy_diag_activitylog.tmpl.json → ...ment_es_deploy_diag_activitylog.tmpl.json b/...ment_es_deploy_diag_activitylog.tmpl.json → ...ment_es_deploy_diag_activitylog.tmpl.json
diff --git a/...ent_es_deploy_diag_loganalytics.tmpl.json → ...ent_es_deploy_diag_loganalytics.tmpl.json b/...ent_es_deploy_diag_loganalytics.tmpl.json → ...ent_es_deploy_diag_loganalytics.tmpl.json
diff --git a/...ignment_es_deploy_vm_monitoring.tmpl.json → ...ignment_es_deploy_vm_monitoring.tmpl.json b/...ignment_es_deploy_vm_monitoring.tmpl.json → ...ignment_es_deploy_vm_monitoring.tmpl.json
diff --git a/...y_definition_es_append_kv_softdelete.json → ...y_definition_es_append_kv_softdelete.json b/...y_definition_es_append_kv_softdelete.json → ...y_definition_es_append_kv_softdelete.json
diff --git a/...efinition_es_deny_aa_child_resources.json → ...efinition_es_deny_aa_child_resources.json b/...efinition_es_deny_aa_child_resources.json → ...efinition_es_deny_aa_child_resources.json
diff --git a/...definition_es_deny_appgw_without_waf.json → ...definition_es_deny_appgw_without_waf.json b/...definition_es_deny_appgw_without_waf.json → ...definition_es_deny_appgw_without_waf.json
diff --git a/.../policy_definition_es_deny_erpeering.json → .../policy_definition_es_deny_erpeering.json b/.../policy_definition_es_deny_erpeering.json → .../policy_definition_es_deny_erpeering.json
diff --git a/...definition_es_deny_private_dns_zones.json → ...definition_es_deny_private_dns_zones.json b/...definition_es_deny_private_dns_zones.json → ...definition_es_deny_private_dns_zones.json
diff --git a/...efinition_es_deny_publicendpoint_aks.json → ...efinition_es_deny_publicendpoint_aks.json b/...efinition_es_deny_publicendpoint_aks.json → ...efinition_es_deny_publicendpoint_aks.json
diff --git a/...tion_es_deny_publicendpoint_cosmosdb.json → ...tion_es_deny_publicendpoint_cosmosdb.json b/...tion_es_deny_publicendpoint_cosmosdb.json → ...tion_es_deny_publicendpoint_cosmosdb.json
diff --git a/...tion_es_deny_publicendpoint_keyvault.json → ...tion_es_deny_publicendpoint_keyvault.json b/...tion_es_deny_publicendpoint_keyvault.json → ...tion_es_deny_publicendpoint_keyvault.json
diff --git a/...ition_es_deny_publicendpoint_mariadb.json → ...ition_es_deny_publicendpoint_mariadb.json b/...ition_es_deny_publicendpoint_mariadb.json → ...ition_es_deny_publicendpoint_mariadb.json
diff --git a/...inition_es_deny_publicendpoint_mysql.json → ...inition_es_deny_publicendpoint_mysql.json b/...inition_es_deny_publicendpoint_mysql.json → ...inition_es_deny_publicendpoint_mysql.json
diff --git a/...on_es_deny_publicendpoint_postgresql.json → ...on_es_deny_publicendpoint_postgresql.json b/...on_es_deny_publicendpoint_postgresql.json → ...on_es_deny_publicendpoint_postgresql.json
diff --git a/...efinition_es_deny_publicendpoint_sql.json → ...efinition_es_deny_publicendpoint_sql.json b/...efinition_es_deny_publicendpoint_sql.json → ...efinition_es_deny_publicendpoint_sql.json
diff --git a/...ition_es_deny_publicendpoint_storage.json → ...ition_es_deny_publicendpoint_storage.json b/...ition_es_deny_publicendpoint_storage.json → ...ition_es_deny_publicendpoint_storage.json
diff --git a/...b/policy_definition_es_deny_publicip.json → ...s/policy_definition_es_deny_publicip.json b/...b/policy_definition_es_deny_publicip.json → ...s/policy_definition_es_deny_publicip.json
diff --git a/...efinition_es_deny_subnet_without_nsg.json → ...efinition_es_deny_subnet_without_nsg.json b/...efinition_es_deny_subnet_without_nsg.json → ...efinition_es_deny_subnet_without_nsg.json
diff --git a/...efinition_es_deny_subnet_without_udr.json → ...efinition_es_deny_subnet_without_udr.json b/...efinition_es_deny_subnet_without_udr.json → ...efinition_es_deny_subnet_without_udr.json
diff --git a/...b/policy_definition_es_deploy_asc_ce.json → ...s/policy_definition_es_deploy_asc_ce.json b/...b/policy_definition_es_deploy_asc_ce.json → ...s/policy_definition_es_deploy_asc_ce.json
diff --git a/...cy_definition_es_deploy_asc_standard.json → ...cy_definition_es_deploy_asc_standard.json b/...cy_definition_es_deploy_asc_standard.json → ...cy_definition_es_deploy_asc_standard.json
diff --git a/...finition_es_deploy_azurebackup_on_vm.json → ...finition_es_deploy_azurebackup_on_vm.json b/...finition_es_deploy_azurebackup_on_vm.json → ...finition_es_deploy_azurebackup_on_vm.json
diff --git a/..._definition_es_deploy_ddosprotection.json → ..._definition_es_deploy_ddosprotection.json b/..._definition_es_deploy_ddosprotection.json → ..._definition_es_deploy_ddosprotection.json
diff --git a/..._definition_es_deploy_diagnostics_aa.json → ..._definition_es_deploy_diagnostics_aa.json b/..._definition_es_deploy_diagnostics_aa.json → ..._definition_es_deploy_diagnostics_aa.json
diff --git a/...definition_es_deploy_diagnostics_aci.json → ...definition_es_deploy_diagnostics_aci.json b/...definition_es_deploy_diagnostics_aci.json → ...definition_es_deploy_diagnostics_aci.json
diff --git a/...definition_es_deploy_diagnostics_acr.json → ...definition_es_deploy_diagnostics_acr.json b/...definition_es_deploy_diagnostics_acr.json → ...definition_es_deploy_diagnostics_acr.json
diff --git a/...on_es_deploy_diagnostics_activitylog.json → ...on_es_deploy_diagnostics_activitylog.json b/...on_es_deploy_diagnostics_activitylog.json → ...on_es_deploy_diagnostics_activitylog.json
diff --git a/...definition_es_deploy_diagnostics_aks.json → ...definition_es_deploy_diagnostics_aks.json b/...definition_es_deploy_diagnostics_aks.json → ...definition_es_deploy_diagnostics_aks.json
diff --git a/...s_deploy_diagnostics_analysisservice.json → ...s_deploy_diagnostics_analysisservice.json b/...s_deploy_diagnostics_analysisservice.json → ...s_deploy_diagnostics_analysisservice.json
diff --git a/...nition_es_deploy_diagnostics_apimgmt.json → ...nition_es_deploy_diagnostics_apimgmt.json b/...nition_es_deploy_diagnostics_apimgmt.json → ...nition_es_deploy_diagnostics_apimgmt.json
diff --git a/...eploy_diagnostics_applicationgateway.json → ...eploy_diagnostics_applicationgateway.json b/...eploy_diagnostics_applicationgateway.json → ...eploy_diagnostics_applicationgateway.json
diff --git a/...finition_es_deploy_diagnostics_batch.json → ...finition_es_deploy_diagnostics_batch.json b/...finition_es_deploy_diagnostics_batch.json → ...finition_es_deploy_diagnostics_batch.json
diff --git a/...n_es_deploy_diagnostics_cdnendpoints.json → ...n_es_deploy_diagnostics_cdnendpoints.json b/...n_es_deploy_diagnostics_cdnendpoints.json → ...n_es_deploy_diagnostics_cdnendpoints.json
diff --git a/...deploy_diagnostics_cognitiveservices.json → ...deploy_diagnostics_cognitiveservices.json b/...deploy_diagnostics_cognitiveservices.json → ...deploy_diagnostics_cognitiveservices.json
diff --git a/...ition_es_deploy_diagnostics_cosmosdb.json → ...ition_es_deploy_diagnostics_cosmosdb.json b/...ition_es_deploy_diagnostics_cosmosdb.json → ...ition_es_deploy_diagnostics_cosmosdb.json
diff --git a/...on_es_deploy_diagnostics_datafactory.json → ...on_es_deploy_diagnostics_datafactory.json b/...on_es_deploy_diagnostics_datafactory.json → ...on_es_deploy_diagnostics_datafactory.json
diff --git a/..._es_deploy_diagnostics_datalakestore.json → ..._es_deploy_diagnostics_datalakestore.json b/..._es_deploy_diagnostics_datalakestore.json → ..._es_deploy_diagnostics_datalakestore.json
diff --git a/...on_es_deploy_diagnostics_dlanalytics.json → ...on_es_deploy_diagnostics_dlanalytics.json b/...on_es_deploy_diagnostics_dlanalytics.json → ...on_es_deploy_diagnostics_dlanalytics.json
diff --git a/...n_es_deploy_diagnostics_eventgridsub.json → ...n_es_deploy_diagnostics_eventgridsub.json b/...n_es_deploy_diagnostics_eventgridsub.json → ...n_es_deploy_diagnostics_eventgridsub.json
diff --git a/...es_deploy_diagnostics_eventgridtopic.json → ...es_deploy_diagnostics_eventgridtopic.json b/...es_deploy_diagnostics_eventgridtopic.json → ...es_deploy_diagnostics_eventgridtopic.json
diff --git a/...ition_es_deploy_diagnostics_eventhub.json → ...ition_es_deploy_diagnostics_eventhub.json b/...ition_es_deploy_diagnostics_eventhub.json → ...ition_es_deploy_diagnostics_eventhub.json
diff --git a/...n_es_deploy_diagnostics_expressroute.json → ...n_es_deploy_diagnostics_expressroute.json b/...n_es_deploy_diagnostics_expressroute.json → ...n_es_deploy_diagnostics_expressroute.json
diff --git a/...ition_es_deploy_diagnostics_firewall.json → ...ition_es_deploy_diagnostics_firewall.json b/...ition_es_deploy_diagnostics_firewall.json → ...ition_es_deploy_diagnostics_firewall.json
diff --git a/...tion_es_deploy_diagnostics_hdinsight.json → ...tion_es_deploy_diagnostics_hdinsight.json b/...tion_es_deploy_diagnostics_hdinsight.json → ...tion_es_deploy_diagnostics_hdinsight.json
diff --git a/...inition_es_deploy_diagnostics_iothub.json → ...inition_es_deploy_diagnostics_iothub.json b/...inition_es_deploy_diagnostics_iothub.json → ...inition_es_deploy_diagnostics_iothub.json
diff --git a/...ition_es_deploy_diagnostics_keyvault.json → ...ition_es_deploy_diagnostics_keyvault.json b/...ition_es_deploy_diagnostics_keyvault.json → ...ition_es_deploy_diagnostics_keyvault.json
diff --git a/...n_es_deploy_diagnostics_loadbalancer.json → ...n_es_deploy_diagnostics_loadbalancer.json b/...n_es_deploy_diagnostics_loadbalancer.json → ...n_es_deploy_diagnostics_loadbalancer.json
diff --git a/...n_es_deploy_diagnostics_logicappsise.json → ...n_es_deploy_diagnostics_logicappsise.json b/...n_es_deploy_diagnostics_logicappsise.json → ...n_es_deploy_diagnostics_logicappsise.json
diff --git a/...on_es_deploy_diagnostics_logicappswf.json → ...on_es_deploy_diagnostics_logicappswf.json b/...on_es_deploy_diagnostics_logicappswf.json → ...on_es_deploy_diagnostics_logicappswf.json
diff --git a/...on_es_deploy_diagnostics_mlworkspace.json → ...on_es_deploy_diagnostics_mlworkspace.json b/...on_es_deploy_diagnostics_mlworkspace.json → ...on_es_deploy_diagnostics_mlworkspace.json
diff --git a/...finition_es_deploy_diagnostics_mysql.json → ...finition_es_deploy_diagnostics_mysql.json b/...finition_es_deploy_diagnostics_mysql.json → ...finition_es_deploy_diagnostics_mysql.json
diff --git a/...oy_diagnostics_networksecuritygroups.json → ...oy_diagnostics_networksecuritygroups.json b/...oy_diagnostics_networksecuritygroups.json → ...oy_diagnostics_networksecuritygroups.json
diff --git a/...definition_es_deploy_diagnostics_nic.json → ...definition_es_deploy_diagnostics_nic.json b/...definition_es_deploy_diagnostics_nic.json → ...definition_es_deploy_diagnostics_nic.json
diff --git a/...ion_es_deploy_diagnostics_postgresql.json → ...ion_es_deploy_diagnostics_postgresql.json b/...ion_es_deploy_diagnostics_postgresql.json → ...ion_es_deploy_diagnostics_postgresql.json
diff --git a/...s_deploy_diagnostics_powerbiembedded.json → ...s_deploy_diagnostics_powerbiembedded.json b/...s_deploy_diagnostics_powerbiembedded.json → ...s_deploy_diagnostics_powerbiembedded.json
diff --git a/...ition_es_deploy_diagnostics_publicip.json → ...ition_es_deploy_diagnostics_publicip.json b/...ition_es_deploy_diagnostics_publicip.json → ...ition_es_deploy_diagnostics_publicip.json
diff --git a/..._es_deploy_diagnostics_recoveryvault.json → ..._es_deploy_diagnostics_recoveryvault.json b/..._es_deploy_diagnostics_recoveryvault.json → ..._es_deploy_diagnostics_recoveryvault.json
diff --git a/...ion_es_deploy_diagnostics_rediscache.json → ...ion_es_deploy_diagnostics_rediscache.json b/...ion_es_deploy_diagnostics_rediscache.json → ...ion_es_deploy_diagnostics_rediscache.json
diff --git a/...finition_es_deploy_diagnostics_relay.json → ...finition_es_deploy_diagnostics_relay.json b/...finition_es_deploy_diagnostics_relay.json → ...finition_es_deploy_diagnostics_relay.json
diff --git a/...es_deploy_diagnostics_searchservices.json → ...es_deploy_diagnostics_searchservices.json b/...es_deploy_diagnostics_searchservices.json → ...es_deploy_diagnostics_searchservices.json
diff --git a/...ion_es_deploy_diagnostics_servicebus.json → ...ion_es_deploy_diagnostics_servicebus.json b/...ion_es_deploy_diagnostics_servicebus.json → ...ion_es_deploy_diagnostics_servicebus.json
diff --git a/...nition_es_deploy_diagnostics_signalr.json → ...nition_es_deploy_diagnostics_signalr.json b/...nition_es_deploy_diagnostics_signalr.json → ...nition_es_deploy_diagnostics_signalr.json
diff --git a/...inition_es_deploy_diagnostics_sqldbs.json → ...inition_es_deploy_diagnostics_sqldbs.json b/...inition_es_deploy_diagnostics_sqldbs.json → ...inition_es_deploy_diagnostics_sqldbs.json
diff --git a/...s_deploy_diagnostics_sqlelasticpools.json → ...s_deploy_diagnostics_sqlelasticpools.json b/...s_deploy_diagnostics_sqlelasticpools.json → ...s_deploy_diagnostics_sqlelasticpools.json
diff --git a/...finition_es_deploy_diagnostics_sqlmi.json → ...finition_es_deploy_diagnostics_sqlmi.json b/...finition_es_deploy_diagnostics_sqlmi.json → ...finition_es_deploy_diagnostics_sqlmi.json
diff --git a/...s_deploy_diagnostics_streamanalytics.json → ...s_deploy_diagnostics_streamanalytics.json b/...s_deploy_diagnostics_streamanalytics.json → ...s_deploy_diagnostics_streamanalytics.json
diff --git a/...eploy_diagnostics_timeseriesinsights.json → ...eploy_diagnostics_timeseriesinsights.json b/...eploy_diagnostics_timeseriesinsights.json → ...eploy_diagnostics_timeseriesinsights.json
diff --git a/...es_deploy_diagnostics_trafficmanager.json → ...es_deploy_diagnostics_trafficmanager.json b/...es_deploy_diagnostics_trafficmanager.json → ...es_deploy_diagnostics_trafficmanager.json
diff --git a/...es_deploy_diagnostics_virtualnetwork.json → ...es_deploy_diagnostics_virtualnetwork.json b/...es_deploy_diagnostics_virtualnetwork.json → ...es_deploy_diagnostics_virtualnetwork.json
diff --git a/..._definition_es_deploy_diagnostics_vm.json → ..._definition_es_deploy_diagnostics_vm.json b/..._definition_es_deploy_diagnostics_vm.json → ..._definition_es_deploy_diagnostics_vm.json
diff --git a/...efinition_es_deploy_diagnostics_vmss.json → ...efinition_es_deploy_diagnostics_vmss.json b/...efinition_es_deploy_diagnostics_vmss.json → ...efinition_es_deploy_diagnostics_vmss.json
diff --git a/...inition_es_deploy_diagnostics_vnetgw.json → ...inition_es_deploy_diagnostics_vnetgw.json b/...inition_es_deploy_diagnostics_vnetgw.json → ...inition_es_deploy_diagnostics_vnetgw.json
diff --git a/..._es_deploy_diagnostics_webserverfarm.json → ..._es_deploy_diagnostics_webserverfarm.json b/..._es_deploy_diagnostics_webserverfarm.json → ..._es_deploy_diagnostics_webserverfarm.json
diff --git a/...nition_es_deploy_diagnostics_website.json → ...nition_es_deploy_diagnostics_website.json b/...nition_es_deploy_diagnostics_website.json → ...nition_es_deploy_diagnostics_website.json
diff --git a/...nszonegroup_for_blob_privateendpoint.json → ...nszonegroup_for_blob_privateendpoint.json b/...nszonegroup_for_blob_privateendpoint.json → ...nszonegroup_for_blob_privateendpoint.json
diff --git a/...nszonegroup_for_file_privateendpoint.json → ...nszonegroup_for_file_privateendpoint.json b/...nszonegroup_for_file_privateendpoint.json → ...nszonegroup_for_file_privateendpoint.json
diff --git a/...negroup_for_keyvault_privateendpoint.json → ...negroup_for_keyvault_privateendpoint.json b/...negroup_for_keyvault_privateendpoint.json → ...negroup_for_keyvault_privateendpoint.json
diff --git a/...szonegroup_for_queue_privateendpoint.json → ...szonegroup_for_queue_privateendpoint.json b/...szonegroup_for_queue_privateendpoint.json → ...szonegroup_for_queue_privateendpoint.json
diff --git a/...dnszonegroup_for_sql_privateendpoint.json → ...dnszonegroup_for_sql_privateendpoint.json b/...dnszonegroup_for_sql_privateendpoint.json → ...dnszonegroup_for_sql_privateendpoint.json
diff --git a/...szonegroup_for_table_privateendpoint.json → ...szonegroup_for_table_privateendpoint.json b/...szonegroup_for_table_privateendpoint.json → ...szonegroup_for_table_privateendpoint.json
diff --git a/..._definition_es_deploy_firewallpolicy.json → ..._definition_es_deploy_firewallpolicy.json b/..._definition_es_deploy_firewallpolicy.json → ..._definition_es_deploy_firewallpolicy.json
diff --git a/.../lib/policy_definition_es_deploy_hub.json → ...ions/policy_definition_es_deploy_hub.json b/.../lib/policy_definition_es_deploy_hub.json → ...ions/policy_definition_es_deploy_hub.json
diff --git a/...olicy_definition_es_deploy_la_config.json → ...olicy_definition_es_deploy_la_config.json b/...olicy_definition_es_deploy_la_config.json → ...olicy_definition_es_deploy_la_config.json
diff --git a/...y_definition_es_deploy_log_analytics.json → ...y_definition_es_deploy_log_analytics.json b/...y_definition_es_deploy_log_analytics.json → ...y_definition_es_deploy_log_analytics.json
diff --git a/...cy_definition_es_deploy_nsg_flowlogs.json → ...cy_definition_es_deploy_nsg_flowlogs.json b/...cy_definition_es_deploy_nsg_flowlogs.json → ...cy_definition_es_deploy_nsg_flowlogs.json
diff --git a/...ition_es_deploy_sql_auditingsettings.json → ...ition_es_deploy_sql_auditingsettings.json b/...ition_es_deploy_sql_auditingsettings.json → ...ition_es_deploy_sql_auditingsettings.json
diff --git a/..._es_deploy_sql_securityalertpolicies.json → ..._es_deploy_sql_securityalertpolicies.json b/..._es_deploy_sql_securityalertpolicies.json → ..._es_deploy_sql_securityalertpolicies.json
diff --git a/.../policy_definition_es_deploy_sql_tde.json → .../policy_definition_es_deploy_sql_tde.json b/.../policy_definition_es_deploy_sql_tde.json → .../policy_definition_es_deploy_sql_tde.json
diff --git a/..._deploy_sql_vulnerabilityassessments.json → ..._deploy_sql_vulnerabilityassessments.json b/..._deploy_sql_vulnerabilityassessments.json → ..._deploy_sql_vulnerabilityassessments.json
@@ -1,10 +1,10 @@
 {
-  "name": "ES-Deploy-Sql-vulnerabilityAssessments",
+  "name": "ES-Deploy-Sql-VulnerabilityAssessments",
   "type": "Microsoft.Authorization/policyDefinitions",
   "apiVersion": "2019-09-01",
   "properties": {
     "description": "Configures SQL DataBases",
-    "displayName": "ES-Deploy-Sql-vulnerabilityAssessments",
+    "displayName": "ES-Deploy-Sql-VulnerabilityAssessments",
     "mode": "All",
     "parameters": {
       "vulnerabilityAssessmentsEmail": {

diff --git a/...lib/policy_definition_es_deploy_vhub.json → ...ons/policy_definition_es_deploy_vhub.json b/...lib/policy_definition_es_deploy_vhub.json → ...ons/policy_definition_es_deploy_vhub.json
diff --git a/...lib/policy_definition_es_deploy_vnet.json → ...ons/policy_definition_es_deploy_vnet.json b/...lib/policy_definition_es_deploy_vnet.json → ...ons/policy_definition_es_deploy_vnet.json
diff --git a/...lib/policy_definition_es_deploy_vwan.json → ...ons/policy_definition_es_deploy_vwan.json b/...lib/policy_definition_es_deploy_vwan.json → ...ons/policy_definition_es_deploy_vwan.json
diff --git a/...inition_es_deploy_windows_domainjoin.json → ...inition_es_deploy_windows_domainjoin.json b/...inition_es_deploy_windows_domainjoin.json → ...inition_es_deploy_windows_domainjoin.json
diff --git a/...inition_es_deny_publicendpoints.tmpl.json → ...inition_es_deny_publicendpoints.tmpl.json b/...inition_es_deny_publicendpoints.tmpl.json → ...inition_es_deny_publicendpoints.tmpl.json
diff --git a/...deploy_diagnositcs_loganalytics.tmpl.json → ...deploy_diagnositcs_loganalytics.tmpl.json b/...deploy_diagnositcs_loganalytics.tmpl.json → ...deploy_diagnositcs_loganalytics.tmpl.json
diff --git a/...finition_es_deploy_sql_security.tmpl.json → ...finition_es_deploy_sql_security.tmpl.json b/...finition_es_deploy_sql_security.tmpl.json → ...finition_es_deploy_sql_security.tmpl.json
diff --git a/...nition_es_network_subnet_contributor.json → ...nition_es_network_subnet_contributor.json b/...nition_es_network_subnet_contributor.json → ...nition_es_network_subnet_contributor.json
diff --git a/...rchetypes/locals.archetype_definitions.tf → ...rchetypes/locals.archetype_definitions.tf b/...rchetypes/locals.archetype_definitions.tf → ...rchetypes/locals.archetype_definitions.tf
@@ -1,13 +1,13 @@
 # Load the built-in archetype definitions from the internal library path
 locals {
-  builtin_archetype_definitions_json = tolist(fileset(local.builtin_library_path, "**archetype_definition_*.json"))
-  builtin_archetype_definitions_yaml = tolist(fileset(local.builtin_library_path, "**archetype_definition_*.{yml,yaml}"))
+  builtin_archetype_definitions_json = tolist(fileset(local.builtin_library_path, "**/archetype_definition_*.json"))
+  builtin_archetype_definitions_yaml = tolist(fileset(local.builtin_library_path, "**/archetype_definition_*.{yml,yaml}"))
 }
 
 # Load the custom archetype definitions from the custom library path if specified
 locals {
-  custom_archetype_definitions_json = local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**archetype_definition_*.json")) : []
-  custom_archetype_definitions_yaml = local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**archetype_definition_*.{yml,yaml}")) : []
+  custom_archetype_definitions_json = local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**/archetype_definition_*.json")) : []
+  custom_archetype_definitions_yaml = local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**/archetype_definition_*.{yml,yaml}")) : []
 }
 
 # Create datasets containing all built-in and custom archetype definitions from each source and file type

diff --git a/...e-archetypes/locals.policy_assignments.tf → ...s/archetypes/locals.policy_assignments.tf b/...e-archetypes/locals.policy_assignments.tf → ...s/archetypes/locals.policy_assignments.tf
@@ -9,10 +9,10 @@ locals {
 
 # If Policy Assignments are specified in the archetype definition, generate a list of all Policy Assignment files from the built-in and custom library locations
 locals {
-  builtin_policy_assignments_from_json = local.archetype_policy_assignments_specified ? tolist(fileset(local.builtin_library_path, "**policy_assignment_*.json")) : null
-  builtin_policy_assignments_from_yaml = local.archetype_policy_assignments_specified ? tolist(fileset(local.builtin_library_path, "**policy_assignment_*.{yml,yaml}")) : null
-  custom_policy_assignments_from_json  = local.archetype_policy_assignments_specified && local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**policy_assignment_*.json")) : null
-  custom_policy_assignments_from_yaml  = local.archetype_policy_assignments_specified && local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**policy_assignment_*.{yml,yaml}")) : null
+  builtin_policy_assignments_from_json = local.archetype_policy_assignments_specified ? tolist(fileset(local.builtin_library_path, "**/policy_assignment_*.json")) : null
+  builtin_policy_assignments_from_yaml = local.archetype_policy_assignments_specified ? tolist(fileset(local.builtin_library_path, "**/policy_assignment_*.{yml,yaml}")) : null
+  custom_policy_assignments_from_json  = local.archetype_policy_assignments_specified && local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**/policy_assignment_*.json")) : null
+  custom_policy_assignments_from_yaml  = local.archetype_policy_assignments_specified && local.custom_library_path_specified ? tolist(fileset(local.custom_library_path, "**/policy_assignment_*.{yml,yaml}")) : null
 }
 
 # If Policy Assignment files exist, load content into dataset
@@ -98,7 +98,15 @@ locals {
       parameters = contains(keys(local.parameters_at_scope), policy_assignment) ? {
         for parameter_key, parameter_value in local.parameters_at_scope[policy_assignment] :
         parameter_key => {
-          value = parameter_value
+          # Due to object type limitations in Go, we can only support
+          # a single object type in the input parameter for parameters.
+          # To support processing parameters with different object
+          # types we've added support for converting the input value
+          # from JSON but can fallback to the raw value if that fails.
+          # This provides backwards compatibility for existing
+          # deployments, but also makes it easier to compose the input
+          # object if only one parameter value type is needed.
+          value = try(jsondecode(parameter_value), parameter_value)
         }
       } : null
     }