Question

如何编写仅在满足以下两个条件的情况下才能创建资源的Azure策略：

为资源分配了一个“所有者”标签
“所有者”标签的值是有效的电子邮件地址格式

编辑：我只会做简单的电子邮件地址验证，因为它只是提醒我公司中的人员使用他们的电子邮件地址而不是其全名。我不是要验证所有个可能的电子邮件地址。

正则表达式可能看起来像这样：

[A-Z0-9a-z._-]+@[A-Za-z0-9.-]+\.[A-Za-z]+

Answer 1

内置了用于强制执行标签及其值的策略，您可以利用这些策略来定制您自己的标签。如果即使不存在也要添加标签，则可以使用新的Modify效果。这是example

{"properties": {
  "displayName": "Add a tag to resources",
  "policyType": "BuiltIn",
  "mode": "Indexed",
  "description": "Adds the specified tag and value when any resource missing this tag is created or updated. Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed. Does not modify tags on resource groups.",
  "metadata": {
     "category": "Tags"
  },
  "parameters": {
     "tagName": {
        "type": "String",
        "metadata": {
           "displayName": "Tag Name",
           "description": "Name of the tag, such as 'environment'"
        }
     },
     "tagValue": {
        "type": "String",
        "metadata": {
           "displayName": "Tag Value",
           "description": "Value of the tag, such as 'production'"
        }
     }
  },
  "policyRule": {
     "if": {
        "field": "[concat('tags[', parameters('tagName'), ']')]",
        "exists": "false"
     },
     "then": {
        "effect": "modify",
        "details": {
           "roleDefinitionIds": [
              "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
           ],
           "operations": [
              {
                 "operation": "add",
                 "field": "[concat('tags[', parameters('tagName'), ']')]",
                 "value": "[parameters('tagValue')]"
              }
           ]
        }
     }
  }
},"id": "/providers/Microsoft.Authorization/policyDefinitions/4f9dc7db-30c1-420c-b61a-e1d640128d26",
   "type": "Microsoft.Authorization/policyDefinitions",
   "name": "4f9dc7db-30c1-420c-b61a-e1d640128d26"
}

现在输入电子邮件地址，您可以尝试使用包含或不包含。信息here

Azure策略：如果所有者标记不存在或不是电子邮件地址，则拒绝

1 个答案: