我们已经为“允许的位置”构建了一个Azure策略。创建了所需的template.json和parameter.json，如下所示： Template.json
在将json文件上传到Azure存储库后尝试使用Azure管道运行时，以下是错误
尽管在template.json中提到了资源，但由于此错误而失败。任何人都可以提供任何见识。
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"listOfAllowedLocations": {
"type": "array"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Authorization/policyDefinitions",
"name": "policylocation",
"apiVersion": "2018-03-01",
"properties": {
"policyType": "Custom",
"displayName": "policylocation",
"description": "",
"mode": "all",
"parameters": {
"listOfAllowedLocations": {
"type": "array",
"metadata": {
"description": "The list of locations that can be specified when deploying resources.",
"displayName": "Allowed locations"
}
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "location",
"notIn": "EastUS"
},
{
"field": "location",
"notEquals": "global"
},
{
"field": "type",
"notEquals": "Microsoft.Compute/virtualMachines"
}
]
},
"then": {
"effect": "deny"
}
}
}
}
]
}
Parameter.json
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-
01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"listOfAllowedLocations": {
"type":"array",
"value": "EastUS"
}
}
}
答案 0 :(得分：1)
当我尝试使用给定的模板和参数文件部署策略时，收到以下错误消息。
{
"error": {
"code": "InvalidDeploymentParameterType",
"message": "The type of deployment parameter 'listOfAllowedLocations' should not be specified. Please see https://aka.ms/resource-manager-parameter-files for details."
}
}
这意味着您有一个未使用的参数（listOfAllowedLocations）。尽管对于大多数语言模式而言，使用未使用的参数可能是可以的，但对于策略而言则不是。首先删除此参数或将此参数添加到您的策略中以便使用。
接下来，基于您收到的误导性错误消息，我对您的部署方法感到好奇。可以采用许多不同的方式部署策略。门户，Powershell，REST API，仅举几例。我更喜欢REST API方法，因为它在定义和使用方面提供了相当多的灵活性和简便性。如果选择REST API，则实际上可以选择两种不同的方法（作为Azure部署或作为策略定义），分别是以下端点。
PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Resources/deployments/{deploymentName}?api-version=2019-10-01
DOCS-https://docs.microsoft.com/en-us/rest/api/resources/deployments/createorupdate
PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}?api-version=2019-09-01
DOCS-https://docs.microsoft.com/en-us/rest/api/resources/policydefinitions/createorupdate
我的首选是部署路线，这是因为它使用azure部署机制来部署策略，该策略提供了一种一致且用户友好的故障排除，重试和检查方法。它还允许您将策略部署为模板文件和参数文件，将部署嵌套在部署中（这在更复杂的用例中很有用），并在部署范围和策略范围中指定参数。但是，部署还存在一些限制，例如，每个订阅和资源组配额（当前为800）。一些定期的房屋清洁将对此有所帮助。
使用Azure部署REST API方法，我鼓励您根据自己的意图尝试以下操作之一。
选项1a：您希望保留“ listOfAllowedLocations”作为参数并在策略中使用它。您还希望在DEPLOYMENT范围内应用该参数，以使生成的部署策略具有静态定义的允许位置列表。
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Resources/deployments/{deploymentName}?api-version=2019-10-01
身体：
{
"location": "eastus",
"properties": {
"mode": "Incremental",
"parameters": {
"listOfAllowedLocations": {
"value": ["eastus"]
}
},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"listOfAllowedLocations": {
"type": "array"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Authorization/policyDefinitions",
"name": "policylocation",
"apiVersion": "2018-03-01",
"properties": {
"policyType": "Custom",
"displayName": "policylocation",
"description": "",
"mode": "all",
"parameters": {},
"policyRule": {
"if": {
"allOf": [
{
"field": "location",
"notIn": "[parameters('listOfAllowedLocations')]"
},
{
"field": "location",
"notEquals": "global"
},
{
"field": "type",
"notEquals": "Microsoft.Compute/virtualMachines"
}
]
},
"then": {
"effect": "deny"
}
}
}
}
]
}
}
}
选项1b：您希望保留“ listOfAllowedLocations”作为参数并在策略中使用它。您还希望在POLICY DEFINITION范围内应用参数，以便在分配时可以操纵允许位置的已部署结果列表。请注意，在策略资源定义（'[['）中，参数的作用域和参数的转义之间存在细微的差异。
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Resources/deployments/{deploymentName}?api-version=2019-10-01
身体：
{
"location": "eastus",
"properties": {
"mode": "Incremental",
"parameters": {},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "Microsoft.Authorization/policyDefinitions",
"name": "policylocation",
"apiVersion": "2018-03-01",
"properties": {
"policyType": "Custom",
"displayName": "policylocation",
"description": "",
"mode": "all",
"parameters": {
"listOfAllowedLocations": {
"type": "array",
"defaultValue": ["eastus"]
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "location",
"notIn": "[[parameters('listOfAllowedLocations')]"
},
{
"field": "location",
"notEquals": "global"
},
{
"field": "type",
"notEquals": "Microsoft.Compute/virtualMachines"
}
]
},
"then": {
"effect": "deny"
}
}
}
}
]
}
}
}
选项2：允许位置的静态定义。基本上，这将避免通过部署或策略分配传递参数的过程。
{
"location": "eastus",
"properties": {
"mode": "Incremental",
"parameters": {},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "Microsoft.Authorization/policyDefinitions",
"name": "policylocation",
"apiVersion": "2018-03-01",
"properties": {
"policyType": "Custom",
"displayName": "policylocation",
"description": "",
"mode": "all",
"parameters": {},
"policyRule": {
"if": {
"allOf": [
{
"field": "location",
"notIn": ["eastus"]
},
{
"field": "location",
"notEquals": "global"
},
{
"field": "type",
"notEquals": "Microsoft.Compute/virtualMachines"
}
]
},
"then": {
"effect": "deny"
}
}
}
}
]
}
}
}
答案 1 :(得分：0)
问题在于该策略未利用listOfAllowedLocations参数。我将其删除，并使该参数只是空的刹车。