Enforce tags and it's value Azure Policy using Terraform

Question

I am trying to enforce user to add a tag and it's value, in my example "Environment" for the name and "Production" for the value. But here I have a problem with my code, an error that I cannot resolve that's why i'm here. The error concerns the parameter "tagValue" and he doesn't seem to be recognized by the existing policy, here "azurerm_policy_definition". Thank you in advance for your help.

variable "requiredTag" {
  default = "environment"
}

variable "requiredValue" {
  default = "production"
}

resource "azurerm_policy_assignment" "requiredTag" {
  name                 = "Deny-RequiredTag-${var.requiredTag}"
  display_name         = "Tag obligatoire '${var.requiredTag}'"
  description          = "Affectation de la stratégie de balise requise pour '${var.requiredTag}'"
  policy_definition_id = "${azurerm_policy_definition.requiredTag.id}"
  scope                = "/subscriptions/0000000000/resourceGroups/PolicyLab"
  parameters           = <<PARAMETERS
  {
    "tagValue": {
        "value": "${var.requiredValue}"
    },
    "tagName": {
        "value": "${var.requiredTag}"
    }
}
PARAMETERS
}

resource "azurerm_policy_definition" "requiredTag" {
  name         = "Deny-RequiredTag-Resource"
  display_name = "Deny a Required Tag on a Resource"
  description  = "Deny all resources for a required tag"
  policy_type  = "Custom"
  mode         = "All"
  policy_rule  = <<POLICY_RULE
  {
    "if": {
      "not": {
        "field": "[concat('tags[', parameters('tagName'), ']')]",
        "equals": "[parameters('tagValue')]"
      }
    },
    "then": {
        "effect": "deny"
    }
}
POLICY_RULE

  parameters   = <<PARAMETERS
  {
    "tagName": {
        "type": "String",
        "metadata": {
            "displayName": "Tag Name",
            "description": "Name of the tag, such as 'environment'"
        }
    },
    "tagValue": {
        "type": "String",
        "metadata": {
            "displayName": "Tag Value",
            "description": "Value of the tag, such as 'production'"
        }
    }
}
PARAMETERS

}

And here this is the error :

    Error: policy.DefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="InvalidPolicyParameterUpdate" Message="The policy contains new parameter(s) 'tagValue' which are not present in the existing policy and have no default value. New parameters may be added to a policy only if they have a default value."

  on main.tf line 34, in resource "azurerm_policy_definition" "requiredTag":
  34: resource "azurerm_policy_definition" "requiredTag" {

Answer 1

The policy contains new parameter(s) 'tagValue' which are not present in the existing policy and have no default value. New parameters may be added to a policy only if they have a default value.

Either delete the existing policy, or add a default value to you terraform script.

    "tagValue": {
        "type": "String",
        "metadata": {
            "displayName": "Tag Value",
            "description": "Value of the tag, such as 'production'"
        },
        "defaultValue": [ "production" ]
    }