Sync-ALZPolicies assignment template files not aligned with caf-entperise-scale archetypes

[heintonny]

Describe the bug
When we sync the ALZ policies the Assignment template files is the closest we get to the archetype definitions as in caf-entperise-scale. The Assignment template files is not fully aligned with the archetype definitions in caf-enterprise-scale, we think they should be aligned.

Ex. The GuardRails (GR) assignment initiative is sugested assigned to management group landing-zones. The archetype for es-landing-zones only sugests the GR assignment for key vault not the complete GR initiative. The defaults and policies in the full GR initiative dont align well with the Online archetype located below es-landing-zone so we think the GR initiative should only be assigned to platform and corp, no online.

https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/blob/main/modules/archetypes/lib/archetype_definitions/archetype_definition_es_landing_zones.tmpl.json

To Reproduce
Steps to reproduce the behavior:

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
From the ALZ-WorkloadGuardRails.jsonc

From the car-enterprise-scale archetype definitions:

EPAC Version
10.6.2

[anwather]

Hi - the workload guard rails assignment file is designed to be able to deploy the workload specific compliance guardrails for ALZ as described at https://www.azadvertizer.net/azpolicyadvertizer_all.html . They are an optional deployment but by default when selected and deployed by the portal experiance they target the platform and landing zones management groups.

Key vault guardrails are the exception - they are always deployed at the platform and landing zone management group as described at https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies - which is why you can see them in the terraform archetypes, and why they are included in the ALZ-Platform-Default.jsonc and ALZ-LandingZones-Default.jsonc files.

There is also a key vault supplementary set of policies which make up the option workload specific guardrails - this is included as part of the ALZ-WorkloadGuardrails.jsonc file.

[heintonny]

Hi Anwather, thanks for clarification. Still not sure if all the default fits very good into Online Archetype, but I will investigate further.

[anwather]

I've closed this for now - feel free to reopen, I would mention that the Online archtetype (for online management group) doesn't have any policies assigned to it by default. Not sure if that is what you mean