如何通过策略将Azure资源锁应用于资源组

Question

我正在尝试创建一个Azure策略，该策略将向订阅中的资源组部署级别为“ CanNotDelete”的资源锁。

当前该策略100％兼容，但是该策略尚未创建任何锁。

我的JSON policy.rules文件中包含以下内容；

   
{
   "if": {
      "field": "type",
      "equals": "Microsoft.Resources/resourceGroups"
   },
   "then": {
      "effect": "deployIfNotExists",
      "details": {
            "type": "Microsoft.Authorization/locks",
            "existenceCondition": {
               "field": "Microsoft.Authorization/locks/level",
               "equals": "CanNotDelete"
         },
         "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/0000-0000-0000-0000-0000000"
],
      "deployment": {
         "properties": {
            "mode": "incremental",
            "template": {
               "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
               "contentVersion": "1.0.0.0",
               "parameters": {
                  "location": {
                     "type": "string"
                  }
               },
               "resources": [
                  {
                     "type": "Microsoft.Authorization/locks",
                     "apiVersion": "2017-04-01",
                     "name": "ResourceLock",
                     "properties": {
                       "level": "CanNotDelete",
                       "notes": "Prevent accidental deletion of resource groups"
                     }
                  }
               ]
            }
         }
      }
   }
}
}  
  

Answer 1

设法通过两个更改使其工作；

1. if语句路径-Microsoft.Resources / subscriptions / resourceGroups
2. 由于某种原因未创建托管标识，这对于'deployIfNotExists'策略效果是必需的。

我希望对遇到相同问题的所有人有所帮助