how to use azurerm_subscription_policy_remediation with existing policy

I'm having trouble reading in a policy as a data block to remediate the policy.

The error is with the scope_id. I have used a azurerm_resouce_group.id, but it says "Policy Assignment Name: "Test-Inherit-RequiredTag-IheritedTag" was not found" I'm trying with the subscription Id , which it then said it expected "/subscriptions/" so I added that. Now it is "malformed or invalid."

I have also tried

scope_id = "/subscriptions/00000000-0000-0000-0000-00000000000/providers/microsoft.authorization/policyassignments/test-inherit-requiredtag-iheritedtag"

What is expected for the scope_id ?

data "azurerm_policy_assignment" "policy_assignment1" {
  name     = "Test-Inherit-RequiredTag-InheritedTag"
  scope_id = "/subscriptions/${var.subscription_id}"
}

resource "azurerm_subscription_policy_remediation" "remediation1" {
  name                 = "remediation1-inherit-tag"
  subscription_id      = var.subscription_id
  policy_assignment_id = data.azurerm_policy_assignment.policy_assignment1.id
}

I tried to use azurerm_subscription_policy_remediation with my existing policy and I was successfully executed the terrafrom_plan & terraform_apply commands.

I have referred the code from this official Terraform exemption document & [official Terraform remediation document] and modified it accordingly.

The module mentioned in the question.

data "azurerm_policy_assignment" "policy_assignment1" {
  name     = "Test-Inherit-RequiredTag-InheritedTag"
  scope_id = "/subscriptions/${var.subscription_id}"
}

It was not worked for me as well, so I ended up modifying the modules as per the requirement and able to produce the output you're looking for.

My main.tf code:-

terraform {

required_providers {

azurerm  =  {

source  =  "hashicorp/azurerm"

version  =  "=3.59.0"

}

}

}

  

provider  "azurerm" {

features {}

}

  

data  "azurerm_subscription"  "example" {}

  

data  "azurerm_policy_set_definition"  "example" {

display_name  =  "Audit machines with insecure password security settings"

}

  

resource  "azurerm_subscription_policy_assignment"  "example" {

name  =  "exampleAssignment"

subscription_id  =  data.azurerm_subscription.example.id

policy_definition_id  =  data.azurerm_policy_set_definition.example.id

location  =  "westus"

  

identity {

type  =  "SystemAssigned"

}

}

  

resource  "azurerm_subscription_policy_remediation"  "example" {

name  =  "example"

subscription_id  =  data.azurerm_subscription.example.id

policy_assignment_id  =  azurerm_subscription_policy_assignment.example.id

}

Output:

While executing terrafrom_plan

While executing terraform_apply

By using the script, I was successfully performed all terraform steps and the desired output.