Governance Constraints - terraform-e2e

🛡️ Governance Constraints - terraform-e2e

• 🔍 Discovery Source
• 📋 Azure Policy Compliance
• 🔄 Plan Adaptations Based on Policies
• 🚫 Deployment Blockers
• 🏷️ Required Tags
• 🔐 Security Policies
• 💰 Cost Policies
• 🌐 Network Policies
• References

Generated by terraform-plan agent | 2026-02-26

This document captures the governance constraints and Azure Policy requirements that must be addressed in the Terraform implementation.

🔍 Discovery Source

[!IMPORTANT] Governance constraints discovered from Azure REST API (includes management group-inherited policies).

Discovery Method: Azure REST API (policyAssignments?api-version=2022-06-01) Subscription: noalz (00858ffc-dded-4f0f-8bbf-e17fff0d47d9) Scope: Subscription + Management Group 2d04cb4c-999b-4e60-a3a7-e8993edc768b

Policy Definition Analysis

[!IMPORTANT] MANDATORY: For all Deny and DeployIfNotExists policies, analysis of policy definition JSON (policyRule) performed below.

Analysis Notes:

• "Block Azure RM Resource Creation" only blocks Classic resources — does NOT block ARM/modern resources. Cleared as non-blocker.
• All Microhack policies use parameterized effects; all confirmed as Deny via assignment parameters.
• "JV-Enforce Resource Group Tags v3" requires 9 tags at the RG level (lowercase keys): environment, owner, costcenter, application, workload, sla, backup-policy, maint-window, technical-contact.
• "Allowed locations" policy excludes global from the deny condition and excludes Microsoft.AzureActiveDirectory/b2cDirectories.

📋 Azure Policy Compliance

[!WARNING] Static Web App region support for swedencentral requires verification. If not supported, a policy exemption for westeurope is needed (see Deployment Blockers section).

🔄 Plan Adaptations Based on Policies

[!NOTE] This section documents how the implementation plan was adapted to comply with discovered Azure Policies.

Architectural Changes

Auto-Applied Resources

Auto-Modified Configurations

🚫 Deployment Blockers

[!CAUTION] CRITICAL: Potential blocker identified for Static Web App regional deployment.

Allowed Locations — Static Web App Region Constraint

• Policy ID: e56962a6-4747-49cd-b67b-bf8b01975c4c
• Assignment: microhack-allowed-locations
• Effect: Deny
• Scope: Subscription
• Enforcement Mode: Default
• Impact: Static Web App was originally planned for westeurope (per azure-defaults skill recommendation). Policy restricts to swedencentral, germanywestcentral, and global only.
• Assessment Date: 2026-02-26

Resolution Options:

1. Deploy SWA to swedencentral (recommended):

   • Azure Static Web Apps has expanded region support significantly. Attempt deployment with location = "swedencentral".
   • Trade-offs: None if region is supported; content remains globally distributed via CDN regardless of staging location.
   • Risk Level: Low — SWA region availability has expanded substantially since initial documentation.

2. Request Policy Exemption for westeurope:

   • Justification: SWA may have limited region support; westeurope is nearest EU region.
   • Duration: Permanent (SWA-specific exception)
   • Risk Level: Low
   • Approval Process: Azure Policy exemption request to tenant admin

Status: ⚠️ Proceed with swedencentral — verify during terraform plan

Next Steps:

• Plan with location = "swedencentral" for SWA
• Verify during terraform plan/apply — if region not supported, escalate to policy exemption

JV-Enforce Resource Group Tags v3 — Extended Tag Set

• Policy ID: 27833bcf-5909-4a37-891c-16a3cb06856d
• Assignment: b1ad1a690a5148ec8707ff17
• Effect: Deny
• Scope: Management Group
• Enforcement Mode: Default
• Impact: Resource groups require 9 tags (not the standard 4). Missing any tag blocks RG creation.
• Assessment Date: 2026-02-26

Resolution: ✅ Plan adapted — all 9 tags included in resource group definition.

Required RG Tags (lowercase keys):

Status: ✅ Resolved — 9 tags included in plan

🏷️ Required Tags

Resource-Level Tags (Deny Policies)

All resources must include these tags:

locals {
  tags = {
    Environment = var.environment  # "dev"
    Project     = var.project      # "terraform-e2e"
    ManagedBy   = "Terraform"
    Owner       = var.owner        # "team-terraform"
  }
}

Resource Group Tags (Deny Policy — 9 Required)

resource "azurerm_resource_group" "this" {
  name     = "rg-terraform-e2e-dev"
  location = var.location

  tags = {
    environment       = var.environment       # "dev"
    owner             = var.owner             # "team-terraform"
    costcenter        = var.project           # "terraform-e2e"
    application       = var.project           # "terraform-e2e"
    workload          = "ecommerce-storefront"
    sla               = "99.5"
    "backup-policy"   = "default"
    "maint-window"    = "weekends"
    "technical-contact" = var.owner           # "team-terraform"
  }
}

[!IMPORTANT] The RG policy uses lowercase tag keys (environment not Environment). The resource-level policies use PascalCase tag keys (Environment, Project). Both sets must be present — the Inherit Tags Modify policy copies RG tags to resources.

%%{init: {'theme':'neutral'}}%%
flowchart TD
    MG["Management Group Tags"] -->|inherited| SUB["Subscription Tags"]
    SUB -->|inherited| RG["Resource Group Tags<br/>(9 required — Deny)"]
    RG -->|inherited via Modify policy| RES["Resource Tags<br/>(2 required — Deny)"]
    POL["Azure Policy<br/>(Modify effect)"] -->|auto-applies| RES
    style POL fill:#FFB900,stroke:#333
    style RES fill:#0078D4,color:#fff,stroke:#333

🔐 Security Policies

💰 Cost Policies

🌐 Network Policies

References

Governance constraints discovered from Azure REST API (management group + subscription scope). See governance-discovery.instructions.md for discovery methodology.