AzOps: Error on creating the policies on Azure

[nishantmittal6239]

Hi Team,
I am trying to use the Azops for deploying the policy to Azure and Currently I am facing one issue.
I am creating policy definition, policy set definition, policy assignment, policy exemptions if any. And normally the sequence is that you create the policy definition then policy set definition, assignment and then exemption if any. But because a line exist in your function "Invoke-AzOpsPush", See line no. 172 and 171 may be also. Why are you sorting the object? Because on this line my sequence of creating the object is getting change and seems like it is sorting based on the alphabetic characters and at this line. Assignment became first thing to deploy which is wrong because definition doesn't exist yet. So please remove this line of code else provide the justification.

Thanks in advance,
Nishant

[StefanIvemo]

The deployment list is sorted alphabetically in the current AzOps version. But in #632 a -CustomSortOrder switch has been added to Invoke-AzOpsPush to enable custom sort order.

An additional step in the validate-deploy pipeline to handle optional ordering at different scopes needs to be added as well. You can track issue #592 for updates.

[daltondhcp]

As Stefan pointed out, we will introduce a new -CustomSortOrder switch in Invoke-AzOpsPush to allow users to control this behavior. This will be included in the next release (1.8.0).

As a side note, there is nothing preventing you from already today authoring/deploying a custom ARM/Bicep template with dependencies between policyDefinitions/policyAssignments. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/resource-dependency

[nishantmittal6239]

Thanks for the response @daltondhcp. I would like to know when release 1.8.0 will be live and available to use?

Regards, Nishant

[daltondhcp]

We are targeting end of this week.

[nishantmittal6239]

Hi Team, I hope the issue mentioned in this discussion is fixed in release 1.8.1? Which is I think the latest release for public use?
Regards,
Nishant

[daltondhcp]

Correct, you can now use the feature mentioned above. Note that you currently will have to do the custom ordering yourself in the pipeline.

[nishantmittal6239]

Thanks. I made this logic to sort the file in correct order. May be you can share the below logic with other as well.

function CustomSortOrder {
param (
[Parameter(Mandatory = $true)]
[string[]]
$ChangeSet
)
$policyObjects = @("policydefinitions", "policysetdefinitions", "policyassignments", "policyexemptions")
$length = $ChangeSet.Count
$sortedChangeSet = [string[]]::new($length);
$count = 0
foreach ($policyObject in $policyObjects) {
foreach ($diff in $ChangeSet) {
if($diff.Split("/")[-1].Contains($policyObject)) {
$sortedChangeSet[$count] = $diff
$count = $count + 1
}
}
}
$removedEmptyItemChangeSet = ($sortedChangeSet | Where-Object { $_ })
return $removedEmptyItemChangeSet
}

[nishantmittal6239]

I have found one more issue.

I have created policy definition, Initiative and assignment. Align all these three object in the correct order. But seems like you are not waiting in between before creating the another object. Once my pipeline failed on Initiative creation says that definition doesn't exist but the definition do exist. I re-ran the pipeline and Initiative and assignment created successfully.
I removed all the object from the portal and rerun the pipeline. This time it failed on assignment complaining Initiative doesn't exist but Initiative do exist. I re-ran the pipeline again and deployment was successful. So please correct this issue.

[daltondhcp]

We will deploy templates as well honor the input ordering (deployment order) using the new -CustomSortOrder switch in Invoke-AzOpsPush. However, like I mentioned during our offline chat yesterday, we cannot guarantee nor control that the backend ARM replication is completed when you do an assignment directly after a definition is created. It is a constraint in the platform and not something that we will solve for in the AzOps module.
In fact, even if you deploy a regular ARM template with PowerShell that have dependsOn between definition/assignment, this can happen.

However, there is nothing stopping you from adding an extra step in the pipeline with "wait time" or validation and run Invoke-AzOpsPush twice - i.e. first deploy all definitions etc -> wait -> deploy assignments. See simple example below...

$PolicyDefinitions = "here we have the changeset/diff with all policydefinitions/policysetdefinitions/whatever"
$PolicyAssignments = "here we have the changeset/diff with all policyAssignments"

Invoke-AzOpsPush -ChangeSet $PolicyDefinitions 
if ($PolicyAssignments) {
   Start-Sleep -Seconds 120 # Whatever time or if you rather want to do validation with get-azpolicydefinition
   Invoke-AzOpsPush -ChangeSet $PolicyAssignments
}