将数组分配给对象属性具有“值：'[parameters(\'tag0\')]'`的`policyDefinitions`时，Bicep`for`循环在policySetDefinition上中断

问题描述 投票：0回答：1

当我部署下面的 Bicep 时，资源 

policySetDefinition0
失败，并显示错误消息“部署‘PolicyDefinitionBatch_20240808-130023’失败，出现错误。显示 1 个错误中的 1 个。状态消息：无法处理模板资源“/providers/Microsoft.Management/managementGroups/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/policySetDefinitions/DeleteMe - 演示失败”的语言表达式位于“50”行和“9”列。找不到模板参数“tag0”，请参阅 https://aka.ms/arm-syntax-parameters 了解使用详细信息。 （代码：无效模板）”。

使用 

for
循环是我最初的方法。在部署尝试中调试并查看 JSON 版本后，我尝试直接使用 
policySetDefinition2
指定数组索引，结果成功了。我知道使用 
map
lambda 创建数组的另一种方法，并且在 
policySetDefinition1
中也有效。我已成功使用 
for
循环将对象数组分配给应用程序网关等资源上的属性，但这些没有需要为策略集定义传递的奇怪字符串分配 
value: '[parameters(\'tag0\')]'
。

虽然我有一个使用 

map
lambda 的解决方案，但我想了解为什么 
for
循环在这种情况下不起作用。

targetScope = 'managementGroup'

var policyDefinitions = [
  'DeleteMe - Demo Fail 00'
  'DeleteMe - Demo Fail 01'
  'DeleteMe - Demo Fail 02'
]

resource policyDefinition 'Microsoft.Authorization/policyDefinitions@2023-04-01' = [
  for item in policyDefinitions: {
    name: replace(item, ' ', '')
    properties: {
      parameters: {
        tag0: {
          type: 'string'
        }
        tag1: {
          type: 'string'
        }
      }
      policyRule: {
        if: {
          anyof: [
            {
              field: '[concat(\'tags[\',parameters(\'tag0\'), \']\')]'
              exists: 'false'
            }
            {
              field: '[concat(\'tags[\',parameters(\'tag1\'), \']\')]'
              exists: 'false'
            }
          ]
        }
        then: {
          effect: 'audit'
        }
      }
    }
  }
]

resource policySetDefinition0 'Microsoft.Authorization/policySetDefinitions@2023-04-01' = {
  name: 'DeleteMe - Demo Fail'
  properties: {
    displayName: 'DeleteMe - Demo Fail'
    description: 'Demo Fail'
    parameters: {
      tag0: {
        type: 'string'
      }
      tag1: {
        type: 'string'
      }
    }
    policyDefinitions: [
      for item in policyDefinitions: {
        policyDefinitionReferenceId: 'Audit Tags for ${item}'
        policyDefinitionId: managementGroupResourceId(
          'Microsoft.Authorization/policyDefinitions',
          '${replace(item, ' ', '')}'
        )
        parameters: {
          tag0: {
            value: '[parameters(\'tag0\')]'
          }
          tag1: {
            value: '[parameters(\'tag1\')]'
          }
        }
      }
    ]
  }
  dependsOn: [policyDefinition]
}

resource policySetDefinition1 'Microsoft.Authorization/policySetDefinitions@2023-04-01' = {
  name: 'DeleteMe - Demo Lambda'
  properties: {
    displayName: 'DeleteMe - Demo Lambda'
    description: 'Demo Lambda'
    parameters: {
      tag0: {
        type: 'string'
      }
      tag1: {
        type: 'string'
      }
    }
    policyDefinitions: map(policyDefinitions, policyDefinition => {
      policyDefinitionReferenceId: 'Audit Tags for ${policyDefinition}'
      policyDefinitionId: managementGroupResourceId(
        'Microsoft.Authorization/policyDefinitions',
        '${replace(policyDefinition, ' ', '')}'
      )
      parameters: {
        tag0: {
          value: '[parameters(\'tag0\')]'
        }
        tag1: {
          value: '[parameters(\'tag1\')]'
        }
      }
    })
  }
  dependsOn: [policyDefinition]
}

resource policySetDefinition2 'Microsoft.Authorization/policySetDefinitions@2023-04-01' = {
  name: 'DeleteMe - Demo Success'
  properties: {
    displayName: 'DeleteMe - Demo Success'
    description: 'Demo Success'
    parameters: {
      tag0: {
        type: 'string'
      }
      tag1: {
        type: 'string'
      }
    }
    policyDefinitions: [
      {
        policyDefinitionReferenceId: 'Audit Tags for ${policyDefinitions[0]}'
        policyDefinitionId: managementGroupResourceId(
          'Microsoft.Authorization/policyDefinitions',
          '${replace(policyDefinitions[0], ' ', '')}'
        )
        parameters: {
          tag0: {
            value: '[parameters(\'tag0\')]'
          }
          tag1: {
            value: '[parameters(\'tag1\')]'
          }
        }
      }
      {
        policyDefinitionReferenceId: 'Audit Tags for ${policyDefinitions[1]}'
        policyDefinitionId: managementGroupResourceId(
          'Microsoft.Authorization/policyDefinitions',
          '${replace(policyDefinitions[1], ' ', '')}'
        )
        parameters: {
          tag0: {
            value: '[parameters(\'tag0\')]'
          }
          tag1: {
            value: '[parameters(\'tag1\')]'
          }
        }
      }
    ]
  }
  dependsOn: [policyDefinition]
}

一些 PowerShell 有助于部署。

$deploymentTimestamp = (Get-Date).ToString('yyyyMMdd-HHmmss')
$deploymentParameterSplat = @{
  Name              = "PolicyDefinitionBatch_$($deploymentTimestamp)"
  ManagementGroupId = (Get-AzContext).Tenant.Id
  Location          = 'East US 2'
  TemplateFile      = '.\demoFail.bicep'
}
New-AzManagementGroupDeployment @deploymentParameterSplat -Verbose

这是部署结果。

enter image description here

在 Azure 门户中查看的部署模板。

{
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "variables": {
        "policyDefinitions": [
            "DeleteMe - Demo Fail 00",
            "DeleteMe - Demo Fail 01",
            "DeleteMe - Demo Fail 02"
        ]
    },
    "resources": [
        {
            "type": "Microsoft.Authorization/policyDefinitions",
            "apiVersion": "2023-04-01",
            "name": "[replace(variables('policyDefinitions')[copyIndex()], ' ', '')]",
            "properties": {
                "parameters": {
                    "tag0": {
                        "type": "string"
                    },
                    "tag1": {
                        "type": "string"
                    }
                },
                "policyRule": {
                    "if": {
                        "anyof": [
                            {
                                "field": "[[concat('tags[',parameters('tag0'), ']')]",
                                "exists": "false"
                            },
                            {
                                "field": "[[concat('tags[',parameters('tag1'), ']')]",
                                "exists": "false"
                            }
                        ]
                    },
                    "then": {
                        "effect": "audit"
                    }
                }
            },
            "copy": {
                "name": "policyDefinition",
                "count": "[length(variables('policyDefinitions'))]"
            }
        },
        {
            "type": "Microsoft.Authorization/policySetDefinitions",
            "apiVersion": "2023-04-01",
            "name": "DeleteMe - Demo Fail",
            "dependsOn": [
                "policyDefinition"
            ],
            "properties": {
                "copy": [
                    {
                        "name": "policyDefinitions",
                        "count": "[length(variables('policyDefinitions'))]",
                        "input": {
                            "policyDefinitionReferenceId": "[format('Audit Tags for {0}', variables('policyDefinitions')[copyIndex('policyDefinitions')])]",
                            "policyDefinitionId": "[managementGroupResourceId('Microsoft.Authorization/policyDefinitions', format('{0}', replace(variables('policyDefinitions')[copyIndex('policyDefinitions')], ' ', '')))]",
                            "parameters": {
                                "tag0": {
                                    "value": "[[parameters('tag0')]"
                                },
                                "tag1": {
                                    "value": "[[parameters('tag1')]"
                                }
                            }
                        }
                    }
                ],
                "displayName": "DeleteMe - Demo Fail",
                "description": "Demo Fail",
                "parameters": {
                    "tag0": {
                        "type": "string"
                    },
                    "tag1": {
                        "type": "string"
                    }
                }
            }
        },
        {
            "type": "Microsoft.Authorization/policySetDefinitions",
            "apiVersion": "2023-04-01",
            "name": "DeleteMe - Demo Lambda",
            "dependsOn": [
                "policyDefinition"
            ],
            "properties": {
                "displayName": "DeleteMe - Demo Lambda",
                "description": "Demo Lambda",
                "parameters": {
                    "tag0": {
                        "type": "string"
                    },
                    "tag1": {
                        "type": "string"
                    }
                },
                "policyDefinitions": "[map(variables('policyDefinitions'), lambda('policyDefinition', createObject('policyDefinitionReferenceId', format('Audit Tags for {0}', lambdaVariables('policyDefinition')), 'policyDefinitionId', managementGroupResourceId('Microsoft.Authorization/policyDefinitions', format('{0}', replace(lambdaVariables('policyDefinition'), ' ', ''))), 'parameters', createObject('tag0', createObject('value', '[parameters(''tag0'')]'), 'tag1', createObject('value', '[parameters(''tag1'')]')))))]"
            }
        },
        {
            "type": "Microsoft.Authorization/policySetDefinitions",
            "apiVersion": "2023-04-01",
            "name": "DeleteMe - Demo Success",
            "dependsOn": [
                "policyDefinition"
            ],
            "properties": {
                "displayName": "DeleteMe - Demo Success",
                "description": "Demo Success",
                "parameters": {
                    "tag0": {
                        "type": "string"
                    },
                    "tag1": {
                        "type": "string"
                    }
                },
                "policyDefinitions": [
                    {
                        "policyDefinitionReferenceId": "[format('Audit Tags for {0}', variables('policyDefinitions')[0])]",
                        "policyDefinitionId": "[managementGroupResourceId('Microsoft.Authorization/policyDefinitions', format('{0}', replace(variables('policyDefinitions')[0], ' ', '')))]",
                        "parameters": {
                            "tag0": {
                                "value": "[[parameters('tag0')]"
                            },
                            "tag1": {
                                "value": "[[parameters('tag1')]"
                            }
                        }
                    },
                    {
                        "policyDefinitionReferenceId": "[format('Audit Tags for {0}', variables('policyDefinitions')[1])]",
                        "policyDefinitionId": "[managementGroupResourceId('Microsoft.Authorization/policyDefinitions', format('{0}', replace(variables('policyDefinitions')[1], ' ', '')))]",
                        "parameters": {
                            "tag0": {
                                "value": "[[parameters('tag0')]"
                            },
                            "tag1": {
                                "value": "[[parameters('tag1')]"
                            }
                        }
                    }
                ]
            }
        }
    ]
}
azure-resource-manager azure-rm-template azure-bicep
1个回答
0
投票

由于 

for
资源中的 
policySetDefinition0
循环而遇到的错误与部署模板中如何引用和使用参数有关，特别是 Bicep 
for
循环的语法。

这是使用 for 循环和 3 Initiative 创建策略定义的正确

bicep code
。

targetScope = 'subscription'
var policyDefinitions = [
  'DeleteMe - Demo Fail 00'
  'DeleteMe - Demo Fail 01'
  'DeleteMe - Demo Fail 02'
]

resource policyDefinition 'Microsoft.Authorization/policyDefinitions@2023-04-01' = [
  for item in policyDefinitions: {
    name: replace(item, ' ', '')
    properties: {
      parameters: {
        tagName: {
          type: 'string'
          defaultValue: 'testing'
        }
        tagValue: {
          type: 'string'
          defaultValue: 'production'
        }
      }
      policyRule: {
        if: {
          anyof: [
            {
              field: '[concat(\'tags[\', parameters(\'tagName\'), \']\')]'
              exists: 'false'
            }
            {
              field: '[concat(\'tags[\', parameters(\'tagValue\'), \']\')]'
              exists: 'false'
            }
          ]
        }
        then: {
          effect: 'audit'
        }
      }
    }
  }
]

// Define policy set definitions
resource policySetDefinitionFail 'Microsoft.Authorization/policySetDefinitions@2023-04-01' = {
  name: 'DeleteMe - Demo Fail'
  properties: {
    displayName: 'DeleteMe - Demo Fail'
    description: 'Demo Fail'
    policyDefinitions: [
      for item in policyDefinitions: {
        policyDefinitionReferenceId: 'Audit Tags for ${item}'
        policyDefinitionId: subscriptionResourceId(
          'Microsoft.Authorization/policyDefinitions',
          replace(item, ' ', '')
        )
        parameters: {
          tagName: {
            value: 'testing'
          }
          tagValue: {
            value: 'production'
          }
        }
      }
    ]
  }
  dependsOn: [policyDefinition]
}

resource policySetDefinitionLambda 'Microsoft.Authorization/policySetDefinitions@2023-04-01' = {
  name: 'DeleteMe - Demo Lambda'
  properties: {
    displayName: 'DeleteMe - Demo Lambda'
    description: 'Demo Lambda'
    policyDefinitions: [
      for item in policyDefinitions: {
        policyDefinitionReferenceId: 'Audit Tags for ${item}'
        policyDefinitionId: subscriptionResourceId(
          'Microsoft.Authorization/policyDefinitions',
          replace(item, ' ', '')
        )
        parameters: {
          tagName: {
            value: 'testing'
          }
          tagValue: {
            value: 'production'
          }
        }
      }
    ]
  }
  dependsOn: [policyDefinition]
}

resource policySetDefinitionSuccess 'Microsoft.Authorization/policySetDefinitions@2023-04-01' = {
  name: 'DeleteMe - Demo Success'
  properties: {
    displayName: 'DeleteMe - Demo Success'
    description: 'Demo Success'
    policyDefinitions: [
      {
        policyDefinitionReferenceId: 'Audit Tags for ${policyDefinitions[0]}'
        policyDefinitionId: subscriptionResourceId(
          'Microsoft.Authorization/policyDefinitions',
          replace(policyDefinitions[0], ' ', '')
        )
        parameters: {
          tagName: {
            value: 'testing'
          }
          tagValue: {
            value: 'production'
          }
        }
      }
      {
        policyDefinitionReferenceId: 'Audit Tags for ${policyDefinitions[1]}'
        policyDefinitionId: subscriptionResourceId(
          'Microsoft.Authorization/policyDefinitions',
          replace(policyDefinitions[1], ' ', '')
        )
        parameters: {
          tagName: {
            value: 'testing'
          }
          tagValue: {
            value: 'production'
          }
        }
      }
      {
        policyDefinitionReferenceId: 'Audit Tags for ${policyDefinitions[2]}'
        policyDefinitionId: subscriptionResourceId(
          'Microsoft.Authorization/policyDefinitions',
          replace(policyDefinitions[2], ' ', '')
        )
        parameters: {
          tagName: {
            value: 'testing'
          }
          tagValue: {
            value: 'production'
          }
        }
      }
    ]
  }
  dependsOn: [policyDefinition]
}

政策输出

enter image description here

策略定义的创建名称为 DeleteMe-DemoFail00

enter image description here

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.