Enterprise Azure Policy as Code (Bash)

This repository contains the Bash implementation of the Enterprise Azure Policy as Code (EPAC) solution. EPAC allows you to manage Azure Policy as code in a git repository using Bash scripts with Azure CLI and jq.

Requirements: Bash 5.1+, Azure CLI 2.50+, jq 1.6+, curl, git

For an overview of the EPAC concept see the upstream EPAC documentation. The docs in this repository (Docs/) have been adapted for the Bash implementation — use those for anything command- or script-specific.

Documentation

The full documentation is in Docs/ and is organized into the following sections (matching mkdocs.yml):

Getting Started

• Overview and Prerequisites
• Hydration Kit
• Manual Configuration
• Extracting Policy Resources
• Forking the GitHub Repo
• Advanced Configuration
• Changes in v11.0.0
• Debugging EPAC

Settings and Desired State

• Global Settings
• Desired State
• Defender for Cloud Assignments
• Output Themes

Azure Landing Zones

• ALZ Overview
• ALZ Policy Integration

Define Policy Resources

• Policy Definitions
• Policy Set Definitions
• Policy Assignment Files
• CSV Assignment Parameters
• Policy Exemptions

CI/CD Integration

• CI/CD Overview
• App Registrations Setup
• Branching Flows
• Azure DevOps Pipelines
• GitHub Actions

Operational Scripts

• Scripts Overview
• Documenting Policy
• Reference

Operator Guidance

• Remediation Enforcement
• Exclusion Management
• Exemption Updates
• Lighthouse Subscription Management

Repository Layout

• lib/ — Bash library modules (core helpers, JSON handling, validators, plans, documentation, exports, hydration, etc.)
• scripts/ — Entry-point scripts grouped by area (deploy/, operations/, hydration/, caf/)
• tests/ — Test suite (run via ./tests/run_all_tests.sh)
• Docs/ — User documentation (rendered by MkDocs)
• StarterKit/, Examples/, Schemas/ — Starter files, examples and JSON schemas
• Scripts/, Module/ — Upstream PowerShell EPAC source, kept as reference only

Contributing

This project welcomes contributions and suggestions. Contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.