azure-policy-reference

Type: regulative

Decision

An exemption must resolve its assignment ID through the platform-generated reference file, not a literal ARM ID.

Why

A hardcoded assignment ID silently breaks every exemption when the platform redeploys.

Violations

• Manually editing policy-assignment-reference.json.
• Exemption naming an assignment with a literal string instead of resolving it through the loaded reference.

Anchor

no-unapproved-resources

Implements

• guardrail

Files

• .github/workflows/lz-flow-create-policy-exemption.yml
• landing-zones/*/policy-assignment-reference.json
• .github/utils/get-policyAssignmentsReference.ps1

Links

• azure-policy-effect-declaration (depends-on) — The reference file is indexed by assignment name, so the name stays stable across redeployments.

← Back to knowledge graph