☁️ Azure Resource Group Policy Exemption Terraform Module

Exempts a resource group from an Azure Policy assignment, with the category, justification and expiry that make the exemption reviewable. Targets hashicorp/azurerm ~> 4.0.

• 🛑 Exempts every resource in a resource group from one policy assignment.
• 🏷️ Records the exemption as Mitigated or Waiver — two materially different claims.
• ⏳ Surfaces never_expires, because an exemption with no end date suppresses a control indefinitely.
• 🎯 Can narrow the exemption to named policy definition references inside an initiative rather than the whole thing.
• 🚧 Enforces Azure's published policyExemptions naming rules, which the provider itself does not check.
• 🔎 Emits is_undocumented_permanent_waiver — the one combination an auditor asks about first.

💡 Why it matters: an exemption does not fix anything. It stops a policy from being evaluated, so the resources underneath vanish from the compliance report rather than appearing and passing. That makes the metadata — why, for how long, by whose decision — the substance of the resource rather than decoration.

If this module saved you time:

• ⭐ Star the repository — it genuinely helps other people find it.
• 💼 Connect on LinkedIn — linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee — buymeacoffee.com/microsoftexpert

flowchart TB
    DEF["terraform-azurerm-policy-definition"]
    SETDEF["terraform-azurerm-policy-set-definition"]
    subgraph assign["Assignments, one module per scope"]
        MGA["terraform-azurerm-management-group-policy-assignment"]
        SUBA["terraform-azurerm-subscription-policy-assignment"]
        RGA["terraform-azurerm-policy-assignment"]
    end
    subgraph exempt["Exemptions, one module per scope, widest first"]
        MGE["terraform-azurerm-management-group-policy-exemption"]
        SUBE["terraform-azurerm-subscription-policy-exemption"]
        RGE["terraform-azurerm-resource-group-policy-exemption"]
        RESE["terraform-azurerm-resource-policy-exemption"]
    end
    RG["terraform-azurerm-resource-group"]
    DEF -->|"assigned by"| SETDEF
    SETDEF -->|"policy_definition_id"| MGA
    SETDEF -->|"policy_definition_id"| SUBA
    SETDEF -->|"policy_definition_id"| RGA
    MGA -->|"policy_assignment_id"| MGE
    SUBA -->|"policy_assignment_id"| SUBE
    RGA -->|"policy_assignment_id"| RGE
    RGA -->|"policy_assignment_id"| RESE
    RG -->|"resource_group_id"| RGE
    RG -->|"contains the resource named in resource_id"| RESE
    style RGE fill:#0078D4,stroke:#004578,color:#ffffff
    style RESE fill:#0078D4,stroke:#004578,color:#ffffff
    style RGA fill:#004578,stroke:#004578,color:#ffffff
    style MGE fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style SUBE fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style MGA fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style SUBA fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style DEF fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style SETDEF fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style RG fill:#F3F2F1,stroke:#8A8886,color:#201F1E

Azure offers policy exemptions at four scopes, as four separate resource types — management group, subscription, resource group and single resource — and this library has one module for each. They are not interchangeable and cannot be switched by changing a variable. Pick the narrowest that solves the problem.

flowchart TB
    SCOPEIN["resource_group_id: WHERE the control stops being evaluated"]
    ASSIGNIN["policy_assignment_id: WHICH assignment is suppressed"]
    CATIN["exemption_category: Mitigated or Waiver"]
    EXPIN["expires_on: the only thing that stops this being permanent"]
    REFIN["policy_definition_reference_ids: narrow it to named policies"]
    THIS["azurerm_resource_group_policy_exemption.this"]
    EFFECT["the assignment is NOT EVALUATED here: nothing is fixed"]
    SCOPEOUT["parsed scope facts for a report"]
    RISK["never_expires and is_undocumented_permanent_waiver"]
    SCOPEIN -->|"FORCE-NEW"| THIS
    ASSIGNIN -->|"FORCE-NEW at three of the four scopes"| THIS
    CATIN -->|"the one required field that updates in place"| THIS
    EXPIN --> THIS
    REFIN -->|"omit and the WHOLE assignment is exempt"| THIS
    THIS --> EFFECT
    THIS --> SCOPEOUT
    THIS --> RISK
    style THIS fill:#0078D4,stroke:#004578,color:#ffffff
    style EFFECT fill:#8A2B06,stroke:#5C1D04,color:#ffffff
    style RISK fill:#8A2B06,stroke:#5C1D04,color:#ffffff
    style ASSIGNIN fill:#004578,stroke:#004578,color:#ffffff
    style SCOPEIN fill:#004578,stroke:#004578,color:#ffffff
    style CATIN fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style EXPIN fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style REFIN fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style SCOPEOUT fill:#F3F2F1,stroke:#8A8886,color:#201F1E

This diagram is shared with terraform-azurerm-resource-policy-exemption, deliberately and with no distinction invented: the two resources are identical in the schema apart from the name of the scope field.

Schema notes that bite, each confirmed against the provider's own source at the pinned version:

• 🔴 policy_assignment_id is force-new here — but NOT at every scope. Resource, resource-group and subscription exemptions all replace when it changes; the management-group exemption updates in place. Three of four behave one way. Nothing in the schema shows this; only the ForceNew flag in each resource's Go source does.
• 🔴 name, the scope ID and policy_assignment_id are force-new; exemption_category is not. A miscategorised exemption can be corrected without replacement.
• ⚠️ The provider validates name only as non-empty. Azure's published rule for policyExemptions is 1–64 characters, no #<>%&:\?/ or control characters, and no trailing period or space. This module enforces the published rule.
• ⚠️ expires_on is stored as an instant and read back as UTC. A value written with an offset is accepted, then read back in Z form, producing a difference on every plan. This module requires the Z form.
• ⚠️ metadata is Optional + Computed. Omitting it does not mean empty — Azure populates its own.
• ⚠️ display_name is capped at 128 characters and description at 512, via StringLenBetween.
• ✅ Create and Update are the same function upstream, gated by d.IsNewResource() — so an update is a full CreateOrUpdate, not a patch.
• No tags. Policy exemptions do not support them.

🔴 The interesting permission question is governance, not RBAC. Anyone who can write a policy exemption at this scope can switch off a compliance control for an entire resource group, and the built-in role that grants it — Resource Policy Contributor — is often handed out with the assignment-creation duties. Separating who may assign policy from who may exempt from it is a deliberate act; Azure does not do it for you.

✅ No secret is involved. This resource accepts none and emits none.

• Microsoft.Authorization is a built-in provider; nothing to register.
• An existing resource group, and an existing policy assignment at or above this scope.
• Where the assignment assigns an initiative and you intend to narrow the exemption, the reference IDs used inside that initiative.
• A review process. This module can record an expiry date and a justification; only a person can act on them.

terraform-azurerm-resource-group-policy-exemption/
├── providers.tf    # required_version + pinned azurerm; no provider block
├── variables.tf    # 4 required inputs, 6 optional, 22 validations
├── main.tf         # the keystone `this` + derived locals
├── outputs.tf      # 21 outputs; id first; none sensitive
├── README.md       # this file
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore      # the canonical library ignore set

provider "azurerm" {
  features {}
}

module "legacy_exemption" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-policy-exemption.git?ref=v1.0.0"

  name                 = "exempt-legacy-storage"
  resource_group_id    = module.rg.id
  policy_assignment_id = module.require_https.id
  exemption_category   = "Mitigated"

  expires_on  = "2027-01-01T00:00:00Z"
  description = "Compensating control: fronted by Application Gateway with TLS termination. Ticket OPS-4471."
}

The caller configures the provider, its authentication and the mandatory features {} block. The module declares none of them.

Consumes

Emits

module "exemption" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-policy-exemption.git?ref=v1.0.0"

  name                 = "exempt-sandbox"
  resource_group_id    = var.resource_group_id
  policy_assignment_id = var.policy_assignment_id
  exemption_category   = "Waiver"
}

exemption_category = "Mitigated"
description        = "Encrypted at rest with a customer-managed key held in the platform vault. Approved in RISK-214."

expires_on = "2027-01-01T00:00:00Z"

policy_definition_reference_ids = [
  "requireHttpsOnStorage",
  "requireTls12",
]

policy_definition_reference_ids = [
  var.security_baseline_reference_ids[0],
]

metadata = jsonencode({
  requestedBy = "team-payments"
  approvedBy  = "security-review-board"
  reviewOn    = "2026-12-01"
  ticket      = "RISK-214"
})

check "exemption_is_reviewable" {
  assert {
    condition     = !module.exemption.is_undocumented_permanent_waiver
    error_message = "A Waiver with no expiry and no description is not reviewable. Add an expiry date, a justification, or both."
  }
}

check "exemptions_expire" {
  assert {
    condition     = module.exemption.has_expiry
    error_message = "Policy exemptions must carry an expiry date under this organisation's standard."
  }
}

locals {
  exemptions = {
    "exempt-https" = { assignment = var.https_assignment_id, category = "Mitigated" }
    "exempt-tags"  = { assignment = var.tags_assignment_id, category = "Waiver" }
  }
}

module "exemptions" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-policy-exemption.git?ref=v1.0.0"
  for_each = local.exemptions

  name                 = each.key
  resource_group_id    = var.resource_group_id
  policy_assignment_id = each.value.assignment
  exemption_category   = each.value.category
  expires_on           = "2027-01-01T00:00:00Z"
}

# Was "Waiver", corrected to:
exemption_category = "Mitigated"

policy_assignment_id = var.new_assignment_id

# This module: every resource in the group, including ones added later.
resource_group_id = var.resource_group_id

# Narrower — a different resource type, a different module:
#   terraform-azurerm-resource-policy-exemption          (exactly one resource)
# Wider — also different resource types:
#   terraform-azurerm-subscription-policy-exemption
#   terraform-azurerm-management-group-policy-exemption

# All REJECTED:
name = "exempt/legacy"        # "/" is in Azure's forbidden set
name = "exempt-legacy."       # may not end with a period
name = "exempt-legacy "       # may not end with a space

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-legacy-payments"
  location = "eastus2"
}

module "require_https" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-policy-definition.git?ref=v1.0.0"

  name         = "require-https-storage"
  display_name = "Storage accounts must require HTTPS"
}

module "assignment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-policy-assignment.git?ref=v1.0.0"

  name                 = "require-https-on-payments"
  resource_group_id    = module.rg.id
  policy_definition_id = module.require_https.id
}

module "exemption" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-policy-exemption.git?ref=v1.0.0"

  name                 = "exempt-legacy-payments"
  resource_group_id    = module.rg.id
  policy_assignment_id = module.assignment.id
  exemption_category   = "Mitigated"

  expires_on  = "2027-01-01T00:00:00Z"
  description = "Legacy gateway terminates TLS upstream; migration tracked in OPS-4471."

  metadata = jsonencode({
    approvedBy = "security-review-board"
    reviewOn   = "2026-12-01"
  })
}

check "exemption_is_reviewable" {
  assert {
    condition     = !module.exemption.is_undocumented_permanent_waiver
    error_message = "This exemption is a permanent, undocumented waiver."
  }
}

output "exemption_expires" {
  value = module.exemption.expires_on
}

No output is sensitive. This resource involves no secret in either direction.

An exemption suppresses evaluation; it does not fix, remediate or grant anything. The resources under this scope stop being assessed against the assignment, so they leave the compliance report rather than appearing in it and passing. Everything else about the module follows from that: the category, the description and the expiry are not decoration but the only record of why a control was switched off, and the only material a later reader has to judge whether it should still be.

The force-new behaviour of policy_assignment_id is not uniform across Azure's four exemption scopes. Resource, resource-group and subscription exemptions replace when it changes; the management-group exemption updates in place. Three of four one way, one the other, with nothing in the schema to show it — the fact lives only in each resource's ForceNew flag in the provider source. This module states which behaviour applies here rather than leaving a reader to generalise from a sibling, because generalising is exactly what goes wrong.

Azure publishes naming rules the provider does not enforce. policyExemptions is documented as 1–64 characters, no #<>%&:\?/ or control characters, no trailing period or space; the provider checks only non-emptiness. Enforcing the published rule here is not inventing a constraint — it is deferring to the authority the provider skipped — and it moves the failure from an API error to a plan error.

expires_on is a round-trip trap. Azure stores an instant and the provider's read formats it back as RFC 3339 in UTC. A caller writing an equivalent value with an offset gets it accepted, stored, and read back in Z form, which never matches the configuration — a difference on every plan that applying never settles. The module rejects the offset form for that reason rather than on stylistic grounds.

What the module deliberately does not do is judge the date. Terraform has no stable notion of "now": any comparison against the current time would produce a value that changes between plan and apply and cause perpetual churn. So the module reports whether an expiry was set and leaves whether it has passed to something that can actually see a clock.

The governance question is sharper than the RBAC one. Writing an exemption at this scope switches off a control for an entire resource group, and the built-in role that permits it travels with ordinary policy-management duties. Separating who may assign policy from who may exempt from it is a decision an organisation has to make deliberately; nothing in Azure or in this module makes it for them.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module with ?ref=v1.0.0, never a branch. This library is plan-only: a human applies from CI.

What the offline gate covers:

• terraform validate proves the configuration parses and every type is satisfied.
• terraform fmt -check proves the HCL is canonically formatted.
• Feeding deliberately bad .tfvars through terraform console fires the input validations — all 22 validation blocks in this module have been proven reachable, each by a fixture that triggers it, with zero condition-evaluation errors.
• All 11 derived locals have been driven to more than one value across the good fixtures, including is_undocumented_permanent_waiver in both states.

What only a real plan or apply can exercise:

• Whether the resource group and the policy assignment exist.
• Whether the assignment actually sits at or above this scope — Azure rejects it otherwise, and nothing offline can tell.
• Whether the named policy definition references exist inside the assigned initiative.
• Whether the expiry date has already passed.

id                                 = "/subscriptions/.../resourceGroups/rg-legacy-payments/providers/Microsoft.Authorization/policyExemptions/exempt-legacy-payments"
name                               = "exempt-legacy-payments"
resource_group_name                = "rg-legacy-payments"
policy_assignment_id               = "/subscriptions/.../providers/Microsoft.Authorization/policyAssignments/require-https-on-payments"
exemption_category                 = "Mitigated"
expires_on                         = "2027-01-01T00:00:00Z"
never_expires                      = false
has_expiry                         = true
exempts_whole_assignment           = true
exempted_reference_count           = 0
is_waiver                          = false
is_mitigated                       = true
is_undocumented_permanent_waiver   = false
has_description                    = true
has_metadata                       = true

• azurerm_resource_group_policy_exemption — provider resource reference.
• Azure Policy exemption structure — what the categories and expiry mean.
• Naming rules and restrictions for Azure resources — the published policyExemptions rule.
• Sibling modules: terraform-azurerm-resource-policy-exemption, terraform-azurerm-subscription-policy-exemption, terraform-azurerm-management-group-policy-exemption, terraform-azurerm-policy-assignment.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."