How to use Azure Enterprise Policy as Code (EPAC) with Terraform as sub-module?

Question

How to use Azure Enterprise Policy as Code (EPAC) with Terraform as sub-module?

Rajesh Swarnkar 911

hello, I need to manage 40+ subscriptions and the Enteprise level Azure policies. Currently we are using Blueprints for defining Customized ARM tempaltes as artifacts.

But since Bluerints are marked for depreaction I am trying to move out of Blueprints altoghther. I took an approach of trying to translate the Custom ARM (which are mostly PolicySet, Policy Definitions and Assignments) into Terraform Resources.

This process is quite slow and error prone. I got to know about Azure EPAC.

But I am unware of whether

EPAC can be used as child module (sub-module) into existing Terraform Repo/Project.
highly unsure how to make use of EPAC + Terraform ?
Is EPAC supports modules as First-Class Citizen in Terraform?

There is similar question out there, but no satifactory answer yet.

Thanks in advance !

Suchitra Suregaunkar 170 Reputation points Microsoft External Staff Moderator

2025-08-04T05:26:50.6433333+00:00
Hello Rajesh Swarnkar,

Thank you for posting your query on Microsoft Q&A portal.

1.EPAC (Enterprise Policy as Code) cannot be directly used as a Terraform sub-module because it is not a Terraform-native module. EPAC is a set of scripts and pipelines (PowerShell + ARM templates) for Azure Policy management, not HCL-based Terraform code.

EPAC is not written in HCL, it's a PowerShell + ARM/Bicep-based solution, so we cannot use EPAC inside a module {} block in Terraform, terraform modules must be in HCL format whereas EPAC is not.

Referral document: Advanced Azure Policy management - Cloud Adoption Framework | Microsoft Learn

2.Use Terraform for infrastructure and EPAC for policy management in separate steps of your CI/CD pipeline:

->Run Terraform to deploy resources.

->Run EPAC scripts (PowerShell + ARM templates) to apply Azure Policies.

3.No, EPAC does not support modules as first-class citizens in Terraform. EPAC is not a Terraform-native module, it is a PowerShell + ARM template based solution for Azure Policy management. You cannot call EPAC using a module block in Terraform.

EPAC has its own concept of policy modules (defined in YAML and folders).

But that is within EPAC only which is not compatible with Terraform module system.

If you need Terraform-native policy-as-code, you should use community modules like gettek/policy-as-code/azurerm from the Terraform Registry.

Here is more detailed example:

Terraform + EPAC Integration in CI/CD Pipeline

Developer Commit → Code pushed to GitHub/Azure Repos.

Pipeline Triggered → CI/CD pipeline starts.

Stage 1: Terraform → Deploys Azure infrastructure using AzureRM provider.

Stage 2: EPAC → Applies Azure Policies via PowerShell + ARM templates for governance.

Azure Environment → Resources + Policies enforced.

Compliance Reporting → EPAC generates dashboards and reports.

So, Terraform handles infrastructure, EPAC handles policy governance.

They run in separate pipeline steps, not as Terraform sub-modules.

Thanks,

Suchitra.
Suchitra Suregaunkar 170 Reputation points Microsoft External Staff Moderator

2025-08-05T07:29:01.31+00:00

Hello Rajesh Swarnkar,

Good day!

Kindly let us know if the solution provided worked for you. If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it.

Thanks,

Suchitra.

Your answer

Suchitra Suregaunkar 170 Reputation points Microsoft External Staff Moderator

2025-08-05T07:29:01.31+00:00

Hello Rajesh Swarnkar,

Good day!

Kindly let us know if the solution provided worked for you. If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it.

Thanks,

Suchitra.

Share via

How to use Azure Enterprise Policy as Code (EPAC) with Terraform as sub-module?

Your answer