I have an Azure Security Benchmark assigned at the Management Group level.

The Azure Security Benchmark has a policy (/providers/Microsoft.Authorization/policyDefinitions/423dd1ba-798e-40e4-9c4d-b6902674b423) that requires Kubernetes clusters to disable automounting API credentials.

I have an Azure Kubernetes Cluster in the subscription that is part of the above said Management Group on which Azure Security Benchmark is applied, and I’m trying to override the Namespace exclusions to include additional namespaces beyond the default Namespace exclusions list.

My exclusion namespace list is as follows:

[
  "kube-system",
  "gatekeeper-system",
  "azure-arc",
  "azuredefender",
  "mdc",
  "azure-extensions-usage-system",
  "ingress",
  "cert-manager",
  "external-dns",
  "external-secrets"
]

This is compared to the default exclusion namespace list:

[
  "kube-system",
  "gatekeeper-system",
  "azure-arc",
  "azuredefender",
  "mdc",
  "azure-extensions-usage-system"
]

To achieve this, I applied the following policy assignment:

resource "azurerm_resource_policy_assignment" "automounting_allowed_namespaces" {
  name                 = "automounting-allowed-namespaces"
  display_name         = "List of the allowed namespaces for automounting API credentials"
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/423dd1ba-798e-40e4-9c4d-b6902674b423"
  resource_id          = var.k8s_cluster_id

  parameters = jsonencode({
    excludedNamespaces = {
      value = [
        "kube-system",
        "gatekeeper-system",
        "azure-arc",
        "azuredefender",
        "mdc",
        "azure-extensions-usage-system",
        "ingress",
        "cert-manager",
        "external-dns",
        "external-secrets"
      ]
    }
  })
}

Despite this, I still see these namespaces under the Affected Components in the Azure policy. I have waited for 4 hours after applying this, would it take 24 hours to reflect?

Can anyone help me understand why this is happening and how I can resolve it?