Update Enforce-Encryption-CMK.json

[oZakari]

Overview/Summary

This pull request includes a small but important change to the Enforce-Encryption-CMK.json file. The change corrects a typo in the "supersededBy" metadata field.

• src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Encryption-CMK.json: Corrected the "supersededBy" field from "Enforce-Encryption-CMK_202502189" to "Enforce-Encryption-CMK_20250218".

Breaking Changes

1. None

Testing Evidence

Please provide any testing evidence to show that your Pull Request works/fixes as described and planned (include screenshots, if appropriate).

Testing URLs

The below URLs can be updated where the placeholders are, look for {YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also} & {YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}, to allow you to test your portal deployment experience.

Please also replace the curly brackets on the placeholders {}

Azure Public

[](https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2F{YOUR GITHUB ORG/ACCOUNT HERE - Remove Curly Brackets Also}%2FEnterprise-Scale%2F{YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2F{YOUR GITHUB ORG/ACCOUNT HERE - Remove Curly Brackets Also}%2FEnterprise-Scale%2F{YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}%2FeslzArm%2Feslz-portal.json)

Azure US Gov (Fairfax)

[](https://portal.azure.us/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2F{YOUR GITHUB ORG/ACCOUNT HERE - Remove Curly Brackets Also}%2FEnterprise-Scale%2F{YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2F{YOUR GITHUB ORG/ACCOUNT HERE - Remove Curly Brackets Also}%2FEnterprise-Scale%2F{YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}%2FeslzArm%2Ffairfaxeslz-portal.json)

As part of this Pull Request I have

• Checked for duplicate Pull Requests
• Associated it with relevant issues, for tracking and closure.
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Ensured contribution guidance is followed.
• Updated relevant and associated documentation.
• Updated the "What's New?" wiki page (located: /docs/wiki/whats-new.md)

[jaredfholgate]

LGTM

[jaredfholgate]

LGTM

[arjenhuitema]

LGTM

[nickchaperon]

Hi

I have been testing the ALZ platform deployment (ADO & TF) and as of this morning am receiving the following error ..

╷
│ Error: Failed to create/update resource
│
│ with module.management_groups.module.management_groups.azapi_resource.policy_set_definitions["alz/Enforce-Encryption-CMK"],
│ on .terraform/modules/management_groups.management_groups/main.policy_set_definitions.tf line 1, in resource "azapi_resource" "policy_set_definitions":
│ 1: resource "azapi_resource" "policy_set_definitions" {
│
│ creating/updating Resource: (ResourceId
│ "/providers/Microsoft.Management/managementGroups/alz/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Encryption-CMK"
│ / Api Version "2023-04-01"): PUT
│ https://management.azure.com/providers/Microsoft.Management/managementGroups/alz/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Encryption-CMK
│ --------------------------------------------------------------------------------
│ RESPONSE 400: 400 Bad Request
│ ERROR CODE: InvalidPolicyParameters
│ --------------------------------------------------------------------------------
│ {
│ "error": {
│ "code": "InvalidPolicyParameters",
│ "message": "The policy set 'Enforce-Encryption-CMK' could not be parameterized because the default value of a policy set parameter referenced by policy definition 76a56461-9dc0-40f0-82f5-2453283afa2f was not valid for that policy definition. Please verify that the default values of all policy set parameters are valid in the context of the policy definitions referencing them. The inner exception 'The value 'Deny' is not allowed for policy parameter 'effect' in policy definition '76a56461-9dc0-40f0-82f5-2453283afa2f'. The allowed values are 'AuditIfNotExists, Disabled'.'."
│ }
│ }
│ --------------------------------------------------------------------------------
│
╵

[jtracey93]

Thanks @nickchaperon we are aware and this PR is part of the fix. We expect to have a fix out today for terraform for this 👍

[nickchaperon]

thanks @jtracey93 .. apologies, wasn't certain there was a connection but noticed there had been a change. Thanks for the update

[jaredfholgate]

thanks @jtracey93 .. apologies, wasn't certain there was a connection but noticed there had been a change. Thanks for the update

Accelerator update is now released. See here for the diff if you have already deployed: https://github.com/Azure/alz-terraform-accelerator/releases/tag/v5.1.0

Our intention is to fix this permanently with policy version pinning, but missing a feature in the SDK to implement. Hoping to have a fix in the next few weeks.