how to assign a policy definition ?

[aisecdk1]

I try to assign policy at a level other than the management group.
I tried:

  assignment_scope  = "/subscriptions/00000000-000000-00000-0000-000000000/" or
  assignment_scope  = data.azurerm_subscription.sub.id

I don't think I can cope
can someone give me an example for subscription, resource group and resource ?

[gettek]

@aisecdk1 can you provide some more context as to the error you are getting please?

[aisecdk1]

of course, I'm very sorry

my code:

data "azurerm_subscription" "sub" {
  subscription_id = "000000000-000000-0000000-0000000-0000000000"
}

module "Allowed-Regions" {
  source     = "git::git@github.com:REPONAME/policy-assignment.git"
  definition = data.azurerm_policy_definition.Allowed-Regions.id 
  assignment_name   = "Allowed-Regions"
  assignment_scope  = data.azurerm_subscription.sub.id 
  assignment_effect = "Deny"

  assignment_parameters = {
    listOfRegionsAllowed = ["japan", "norway"] 
  }

  assignment_metadata = {
    version  = "1.0.0"
    category = "Batch"
    cloud_envs = [
      "AzureCloud",

....
....

I get this error:

│ Error: Unsupported attribute
│ 
│   on .terraform/modules/Allowed-Regions/main.tf line 46, in resource "azurerm_subscription_policy_assignment" "def":
│   46:   policy_definition_id = var.definition.id
│     ├────────────────
│     │ var.definition is "/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyDefinitions/Allowed-Regions"
│ 
│ Can't access attributes on a primitive-typed value (string).
╵
Releasing state lock. This may take a few moments...
Error: Process completed with exit code 1.

if i change scope to:

assignment_scope  = "/subscriptions/000000000-000000-0000000-0000000-0000000000/"

then I have an error

│ Error: Unsupported attribute

│ 
│   on .terraform/modules/Allowed-Regions/outputs.tf line 3, in output "id":
│    3:   value       = local.assignment.id
│     ├────────────────
│     │ local.assignment is ""
│ 
│ Can't access attributes on a primitive-typed value (string).
╵
Releasing state lock. This may take a few moments...
Error: Process completed with exit code 1.

where should I look for the error and what to correct?

[gettek]

@aisecdk1, try removing .id from the assignment parameter: definition = data.azurerm_policy_definition.Allowed-Regions