Update azurerm_policy_remediation - Support resource_discovery_mode

azurerm/internal/services/policy/policy_remediation_resource.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/services/policyinsights/mgmt/2019-10-01/policyinsights"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/suppress"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/tf"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients"
@@ -77,6 +78,16 @@ func resourceArmPolicyRemediation() *schema.Resource {
 				// TODO: remove this suppression when github issue https://github.com/Azure/azure-rest-api-specs/issues/8353 is addressed
 				DiffSuppressFunc: suppress.CaseDifference,
 			},
+
+			"resource_discovery_mode": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  string(policyinsights.ExistingNonCompliant),
+				ValidateFunc: validation.StringInSlice([]string{
+					string(policyinsights.ExistingNonCompliant),
+					string(policyinsights.ReEvaluateCompliance),
+				}, false),
+			},
 		},
 	}
 }
@@ -111,6 +122,7 @@ func resourceArmPolicyRemediationCreateUpdate(d *schema.ResourceData, meta inter
 			},
 			PolicyAssignmentID:          utils.String(d.Get("policy_assignment_id").(string)),
 			PolicyDefinitionReferenceID: utils.String(d.Get("policy_definition_reference_id").(string)),
+			ResourceDiscoveryMode:       policyinsights.ResourceDiscoveryMode(d.Get("resource_discovery_mode").(string)),
 		},
 	}
 
@@ -177,6 +189,7 @@ func resourceArmPolicyRemediationRead(d *schema.ResourceData, meta interface{})
 
 		d.Set("policy_assignment_id", props.PolicyAssignmentID)
 		d.Set("policy_definition_reference_id", props.PolicyDefinitionReferenceID)
+		d.Set("resource_discovery_mode", string(props.ResourceDiscoveryMode))
 	}
 
 	return nil

azurerm/internal/services/policy/tests/policy_remediation_resource_test.go

@@ -25,8 +25,25 @@ func TestAccAzureRMPolicyRemediation_atSubscription(t *testing.T) {
 				Config: testAccAzureRMPolicyRemediation_atSubscription(data),
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "scope"),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "policy_assignment_id"),
+				),
+			},
+			data.ImportStep(),
+		},
+	})
+}
+
+func TestAccAzureRMPolicyRemediation_atSubscriptionWithDiscoveryMode(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_policy_remediation", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMPolicyRemediationDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureRMPolicyRemediation_atSubscriptionWithDiscoveryMode(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
 				),
 			},
 			data.ImportStep(),
@@ -47,8 +64,6 @@ func TestAccAzureRMPolicyRemediation_atSubscriptionWithDefinitionSet(t *testing.
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
 					resource.TestCheckResourceAttrSet(data.ResourceName, "scope"),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "policy_assignment_id"),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "policy_definition_reference_id"),
 				),
 			},
 			data.ImportStep(),
@@ -68,8 +83,6 @@ func TestAccAzureRMPolicyRemediation_atResourceGroup(t *testing.T) {
 				Config: testAccAzureRMPolicyRemediation_atResourceGroup(data),
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "scope"),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "policy_assignment_id"),
 				),
 			},
 			data.ImportStep(),
@@ -89,8 +102,6 @@ func TestAccAzureRMPolicyRemediation_atManagementGroup(t *testing.T) {
 				Config: testAccAzureRMPolicyRemediation_atManagementGroup(data),
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "scope"),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "policy_assignment_id"),
 				),
 			},
 			data.ImportStep(),
@@ -110,8 +121,6 @@ func TestAccAzureRMPolicyRemediation_atResource(t *testing.T) {
 				Config: testAccAzureRMPolicyRemediation_atResource(data),
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "scope"),
-					resource.TestCheckResourceAttrSet(data.ResourceName, "policy_assignment_id"),
 				),
 			},
 			data.ImportStep(),
@@ -131,14 +140,13 @@ func TestAccAzureRMPolicyRemediation_updateLocation(t *testing.T) {
 				Config: testAccAzureRMPolicyRemediation_atResourceGroup(data),
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
-					resource.TestCheckResourceAttr(data.ResourceName, "location_filters.#", "0"),
 				),
 			},
+			data.ImportStep(),
 			{
 				Config: testAccAzureRMPolicyRemediation_updateLocation(data),
 				Check: resource.ComposeTestCheckFunc(
 					testCheckAzureRMPolicyRemediationExists(data.ResourceName),
-					resource.TestCheckResourceAttr(data.ResourceName, "location_filters.#", "1"),
 				),
 			},
 			data.ImportStep(),
@@ -283,6 +291,74 @@ resource "azurerm_policy_remediation" "test" {
 `, data.RandomString)
 }
 
+func testAccAzureRMPolicyRemediation_atSubscriptionWithDiscoveryMode(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+data "azurerm_subscription" "current" {}
+
+resource "azurerm_policy_definition" "test" {
+  name         = "acctestDef-%[1]s"
+  policy_type  = "Custom"
+  mode         = "All"
+  display_name = "my-policy-definition"
+
+  policy_rule = <<POLICY_RULE
+    {
+    "if": {
+      "not": {
+        "field": "location",
+        "in": "[parameters('allowedLocations')]"
+      }
+    },
+    "then": {
+      "effect": "audit"
+    }
+  }
+POLICY_RULE
+
+  parameters = <<PARAMETERS
+    {
+    "allowedLocations": {
+      "type": "Array",
+      "metadata": {
+        "description": "The list of allowed locations for resources.",
+        "displayName": "Allowed locations",
+        "strongType": "location"
+      }
+    }
+  }
+PARAMETERS
+}
+
+resource "azurerm_policy_assignment" "test" {
+  name                 = "acctestAssign-%[1]s"
+  scope                = data.azurerm_subscription.current.id
+  policy_definition_id = azurerm_policy_definition.test.id
+  description          = "Policy Assignment created via an Acceptance Test"
+  display_name         = "My Example Policy Assignment"
+
+  parameters = <<PARAMETERS
+{
+  "allowedLocations": {
+    "value": [ "West Europe" ]
+  }
+}
+PARAMETERS
+}
+
+resource "azurerm_policy_remediation" "test" {
+  name                 = "acctestremediation-%[1]s"
+  scope                = azurerm_policy_assignment.test.scope
+  policy_assignment_id = azurerm_policy_assignment.test.id
+
+  resource_discovery_mode = "ReEvaluateCompliance"
+}
+`, data.RandomString)
+}
+
 func testAccAzureRMPolicyRemediation_atSubscriptionWithDefinitionSet(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {

website/docs/r/policy_remediation.html.markdown

@@ -95,6 +95,8 @@ The following arguments are supported:
 
 * `location_filters` - (Optional) A list of the resource locations that will be remediated.
 
+* `resource_discovery_mode` - (Optional) The way that resources to remediate are discovered. Possible values are `ExistingNonCompliant`, `ReEvaluateCompliance`. Defaults to `ExistingNonCompliant`.
+
 ## Attributes Reference
 
 The following attributes are exported: