refactor: Separation of policy assignments module to avoid hitting ARM size limit and include workload specific policy assignments

[oZakari]

Overview/Summary

As part of the PR, I have created a new module called workloadSpecificPolicyAssignments.bicep which is used to assign all of the policies here. Although assigned, they are set to DoNotEnforce which equates to putting them in audit mode.

I have also refactored the alzDefaultPolicyAssignments.bicep file to remove the Sovereign Landing Zone policy assignments and exemptions (and associated parameters) which have now been moved to the workloadSpecificPolicyAssignments.bicep. This change implemented to reduce the size of the compiled deployment in relation to this issue.

Related Issues/Work Items

Fixed AB#202503

This PR fixes/adds/changes/removes

Configuration Updates:

• Added a new workload-specific policy assignment to the accelerator/.config/ALZ-Powershell-Auto.config.json file. This includes specifying the template and parameter file paths, management group ID, deployment type, and order.
• Adjusted the order of existing policy assignments to accommodate the new workload-specific policy assignment. [1] [2] [3] [4] [5] [6]

Documentation Updates:

• Updated the AssigningPolicies.md file to include the new workload-specific policy assignments module and removed the pre-requisites section. [1] [2]
• Updated the DeploymentFlow.md file to include the new workload-specific policy assignments module in the deployment order. [1] [2]

Codebase Simplification:

• Removed the policyAssignmentSovereigntyGlobalOptionsType and policyAssignmentSovereigntyConfidentialOptionsType types from the alzDefaultPolicyAssignments.bicep file.

Breaking Changes

1. This PR introduces breaking changes with the alzDefaultPolicyAssignments.bicep module as we have removed the following parameters associated to Sovereign Landing Zones. These associated policy assignments and exemptions have been moved to the workloadSpecificPolicyAssignments.bicep module.

   • parTopLevelPolicyAssignmentSovereigntyGlobal
   • parPolicyAssignmentSovereigntyConfidential
   • parAllowedVirtualMachineSKUs

Testing Evidence

Replace this with any testing evidence to show that your Pull Request works/fixes as described and planned (include screenshots, if appropriate).

As part of this Pull Request I have

• Read the Contribution Guide and ensured this PR is compliant with the guide
• Ensured the resource API versions in .bicep file/s I am adding/editing are using the latest API version possible
• Checked for duplicate Pull Requests
• Associated it with relevant GitHub Issues
• (ALZ Bicep Core Team Only) Associated it with relevant ADO Items
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Updated one or more of the following tests (if required)
  • Unit
  • Linting
  • E2E (End-To-End)
  • ValidateAzCloud (Base validation in Azure Cloud)
  • ValidateMcCloud (Base validation in Azure China Cloud)
• Updated relevant and associated documentation (e.g. Contribution Guide, Module READMEs, Wiki Docs etc.)
• If relevant, created or updated Code Tours here

[Copilot]

Pull Request Overview

This PR refactors the policy assignments module to separate workload-specific policy assignments, addressing ARM template size limitations while streamlining the documentation and codebase.

• Added documentation for the new workload-specific policy assignments module.
• Adjusted the order and descriptions in both policy assignments and deployment documentation.
• Removed deprecated types from the policy assignments Bicep file.

Reviewed Changes

Copilot reviewed 45 out of 45 changed files in this pull request and generated no comments.

File	Description
docs/wiki/AssigningPolicies.md	Updated to reference the new workload-specific module and adjusted the instructions for policy assignment exclusion.
infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md	Revised parameter documentation to reflect changes in policy enforcement and removed deprecated parameters.
docs/wiki/AddingPolicyDefs.md	Removed the pre-requisites section to streamline the procedure for adding custom policy definitions.
docs/wiki/DeploymentFlow.md	Updated the module deployment order and added the workload-specific policy assignments row.