Azure policy Terraform import '' expected type 'string', got unconvertible type '[]interface {}'

Question

Created Azure policy to Enforce labels on pods in Kubernetes cluster as below.

Policy Name: Enforce labels on pods in Kubernetes cluster

I am trying to import policy using below command

terraform import azurerm_policy_set_definition.test /subscriptions/<SubscriptionId>/providers/Microsoft.Authorization/policySetDefinitions/<Id>

Whenever I am trying to import resource using terraform, getting below error.

Error: setting `policy_definition_reference`: policy_definition_reference.0.parameters.labelsList: '' expected type 'string', got unconvertible type '[]interface {}'

Any help much appreciated.

Answer 1

It's similar to the issue in Github. I also think it looks like the parameters need to be fixed. You can see the policy_definition_reference.0.parameters is a mapping of the parameter values for the referenced policy rule and each member needs a string value. But the Policy Set Definition in Azure, the parameters property is an object in the JSON format like this:

Maybe it cannot convert from an object into a string in Terraform.

And I think you also need to change the format you input in the Azure portal, it should be the same as the namespace, without quotes and separated with the character ;.

Answer 2

If you hover over the ⓘ for List of labels it gives you a hint about how to submit values to the field. You need to have labels separated with a ;. I suspect terraform is incorrectly interpreting the values as JSON.

Answer 3

EDIT: I misspoke, this bug was fixed sooner than I thought. It was fixed in azurerm 2.29.0

This could be because of this bug in the azurerm provider. A fix is in the works but they mention it will likely not be released until the next major release of the azurerm provider (3.0). I ran into this issue and had to change existing initiative definitions to have parameters at the initiative level, rather than per policy inside of policy_definition_reference and have the policy parameters reference the parameters of the initiative. Not sure if this is the best way to get around this as modifying initiative parameters requires that that the initiative has no policy assignments.