Question

我正在尝试为Azure CIS创建策略，并且在尝试通过Powershell在管理组级别上部署它时遇到以下错误-我试图找出缺少的内容，因为它表示无效的模板。

错误似乎与示波器有关，但不确定到底发生了什么

New-AzManagementGroupDeployment : 1:19:17 AM - The deployment 'cis1.23-azurepolicy' failed with error(s). Showing 1 out of 1 error(s).
Status Message: Unable to process template language expressions for resource
'/providers/Microsoft.Management/managementGroups/MGName/providers/Microsoft.Authorization/policyDefinitions/CIS1.23-EnsureNoCustomerOwnerRoles' at line '23' and
column '9'. 'The deployment metadata 'SUBSCRIPTION' is not valid.' (Code:InvalidTemplate)

这是模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "effect": {
      "type": "string",
      "metadata": {
        "displayName": "Effect",
        "description": "Enable or disable the execution of the policy"
      },
      "allowedValues": [
        "Audit",
        "Disabled"
      ],
      "defaultValue": "Audit"
    }
  },
  "variables": {},
  "resources": [
    {
        "name": "CIS1.23-EnsureNoCustomerOwnerRoles",
      "type": "Microsoft.Authorization/policyDefinitions",
      "apiVersion": "2018-03-01",
      "properties": {
        "policyType": "Custom",
        "displayName": "CIS 1.23 Custom Owner Roles should not exist (Not Scored)",
        "description": "This policy checks that Custom Roles with Owner privileges are removed",
        "mode": "all",
        "metadata": {
          "category": "Identity"
          
        },
        "parameters": {
          "effect": {
            "type": "String",
            "metadata": {
              "displayName": "Effect",
              "description": "Enable or disable the execution of the policy"
            },
            "allowedValues": [
              "Audit",
              "Disabled"
            ],
            "defaultValue": "Audit"
          }
        
        },
        "policyRule": {
          "if": {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Authorization/roleDefinitions"
              },
              {
                "field": "Microsoft.Authorization/roleDefinitions/type",
                "equals": "CustomRole"
              },
              {
                "anyOf": [
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/permissions[*].actions[*]",
                      "notEquals": "*"
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/permissions.actions[*]",
                      "notEquals": "*"
                    }
                  }
                ]
              },
              {
                "anyOf": [
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/assignableScopes[*]",
                      "notIn": [
                        "[concat(subscription().id,'/')]",
                        "[subscription().id]",
                        "/"
                      ]
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/assignableScopes[*]",
                      "notLike": "/providers/Microsoft.Management/*"
                    }
                  }
                ]
              }
            ]
          },
          "then": {
            "effect": "[parameters('effect')]"
          }
        }
      }
    }

Answer 1

您正在将ARM模板部署到管理组，但是您引用的是ARM模板subscription（）函数。 subscription（）函数仅在部署到订阅或资源组时才有效。部署到管理组时，没有可以引用的订阅。

要解决此问题，您需要将此策略部署到预订，而不是管理组。

使用Powershell部署Azure Json策略时出错

1 个答案: