fix(policy): correct AKSIngressHttpsOnlyEffect casing in Enforce-EncryptTransit_20241211 (#4131, #4189)

[Shaik Naseeruddin (NaseerDevops-1994)]

Overview/Summary

Fixes the parameter casing on AKSIngressHttpsOnlyEffect in the Enforce-EncryptTransit_20241211 policy set definition.

The parameter used lowercase values (deny / audit / disabled) while every other effect parameter in the same initiative uses PascalCase. Built-in policy 1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d v9.0.0 dropped the lowercase aliases and now accepts only Audit / Deny / Disabled (v8.1.0/v8.2.0 still tolerate both cases).

When this reference resolves to v9.0.0, ARM rejects the lowercase default at initiative parameterization with InvalidPolicyParameters … using version '9.0.0'. That happens for deployments where the reference is unpinned and floats to the latest built-in — which was the case before the definitionVersion: "8.*.*" pin was introduced (Policy Refresh Q2 FY25). The current 8.*.* pin mitigates the error by resolving to v8.2.0 (still lowercase-tolerant), but it anchors the initiative to a superseded major and leaves the casing inconsistent with every other effect parameter. Portal, Bicep, and Terraform all consume this shared source.

Resolves #4131 and #4189.

This PR fixes/adds/changes/removes

1. Changes AKSIngressHttpsOnlyEffect defaultValue to Deny and allowedValues to ["Audit", "Deny", "Disabled"] (PascalCase), aligning it with every other effect parameter and with built-in 1a5b4dca v9.0.0.
2. Updates the policy definition reference definitionVersion from 8.*.* to 9.*.*.
3. Bumps metadata.version 1.2.2 → 1.2.3 and regenerates eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json.

Breaking Changes

1. None. The default effective behaviour is unchanged (Deny); only the casing/version is corrected so the initiative can be created and assigned successfully. The deprecated Enforce-EncryptTransit_20240509 is intentionally left unchanged.

Testing Evidence

Validated on Azure Public by deploying the policy set definition via ARM (az deployment sub create) into a test subscription, isolating the parameter casing under the referenced built-in policy version 9.0.0:

Scenario	AKSIngressHttpsOnlyEffect default	definitionVersion	Result
Current main (pin mitigates)	deny (lowercase)	8.*.*	✅ Succeeded — resolves to v8.2.0 (lowercase-tolerant)
Unpinned / latest (reproduces customer error)	deny (lowercase)	9.*.*	❌ Failed — InvalidPolicyParameters (v9.0.0)
This fix	Deny (PascalCase)	9.*.*	✅ Succeeded

The failing deployment returned the exact error reported by customers:

The policy set could not be parameterized because the default value of a policy set parameter referenced by policy definition 1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d using version 9.0.0 was not valid for that policy definition. ... The value 'deny' is not allowed for policy parameter 'effect' in policy definition 1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d. The allowed values are 'Audit, Deny, Disabled'. (Code: InvalidPolicyParameters)

Screenshots of the failed (before) and succeeded (after) deployments:

Before — pr4189-arm-buggy2 (lowercase deny, 9.*.*) — deployment failed with InvalidPolicyParameters:

After — pr4189-arm-fixed (PascalCase Deny, 9.*.*) — deployment succeeded:

Testing URLs

Azure Public

As part of this Pull Request I have

• Checked for duplicate Pull Requests
• Associated it with relevant issues, for tracking and closure (#4131, #4189).
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Ensured contribution guidance is followed (ran bicep build to regenerate initiatives.json, bumped metadata.version).
• Updated relevant and associated documentation.
• Created a pull request to updated the "What's New?" wiki page.

[Shaik Naseeruddin (NaseerDevops-1994)]

@microsoft-github-policy-service agree company="Microsoft"