New-AzPolicyDefinition 通过 PowerShell 创建 Azure 策略定义

Question

我正在尝试创建 Azure 策略定义但出现错误。此 JSON 代码取自 Azure 策略“应禁用虚拟机上的 IP 转发”的内置脚本下面是我的脚本

$Policy=
'{
  "properties": {
    "displayName": "Disable-IP-Forwarding",
    "policyType": "Custom",
    "mode": "All",
    "description": "Disable-IP-Forwarding-Test.",
    "metadata": {
      "version": "1.0.1",
      "category": "Security Center"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.Compute/virtualMachines",
          "Microsoft.ClassicCompute/virtualMachines"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/complianceResults",
          "name": "disableIPForwarding",
          "existenceCondition": {
            "field": "Microsoft.Security/complianceResults/resourceStatus",
            "in": [
              "Monitored",
              "OffByPolicy",
              "Healthy"
            ]
          }
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/Disable-IP-Forwarding",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "Disable-IP-Forwarding"
}'

$definition = New-AzPolicyDefinition    -Name "Disable-IP-Forwarding"  -Description "Disable-IP-Forwarding-Test." -Policy $Policy

下面是 Powershell 显示错误的图片。1 & 2

https://i.stack.imgur.com/Ttj4w.png https://i.stack.imgur.com/K0JCv.png

我还尝试删除策略规则中的单引号，如 here(click Here)

**错误：删除单引号后**

New-AzPolicyDefinition：InvalidPolicyRule：无法解析策略规则：“无法在 'PolicyRuleDefinition' 类型的对象上找到成员 'properties'。路径 'properties'.'. CorrelationId：7e754d56-2e8e-4323-8650-ae620bb60573 在 line:70 char:15

... efinition = New-AzPolicyDefinition -Name "Disable-IP-Forwarding" ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : CloseError: (:) [New-AzPolicyDefinition], ErrorResponseMessageException
- FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzurePolicyDefinitionCmdlet

Answer 1

根据 documentation，当您使用 New-AzPolicyDefinition PowerShell 命令创建策略定义时。您的策略定义应采用以下格式：

{
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.Compute/virtualMachines",
          "Microsoft.ClassicCompute/virtualMachines"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/complianceResults",
          "name": "disableIPForwarding",
          "existenceCondition": {
            "field": "Microsoft.Security/complianceResults/resourceStatus",
            "in": [
              "Monitored",
              "OffByPolicy",
              "Healthy"
            ]
          }
        }
      }
    }
}

您可以将描述、模式、元数据、显示名称作为命令中的参数传递。

另一个问题，删除单引号并传递 "[parameters(effect)]"，这将给您带来另一个错误。因此，传递策略定义的最佳方式是将其保存在 json 文件中并将路径传递给命令。

$definition = New-AzPolicyDefinition    -Name "Disable-IP-Forwarding"  -Description "Disable-IP-Forwarding-Test." -Policy "D:\Learning\policy1.json"

Answer 2

我按照下面的 link 计算出来，为 JSON 正文使用了 Here-String： [link] (powershell.org/2019/04/hear-hear-for-here-strings)

New-AzPolicyDefinition 通过 PowerShell 创建 Azure 策略定义

New-AzPolicyDefinition Creation of Azure policy definition through PowerShell

json

powershell

azure-policy