使用 powershell 部署 Azure Json 策略时出错

Question

我正在尝试为 Azure CIS 创建一个策略，当我尝试在管理组级别通过 powershell 部署它时出现以下错误 - 我试图找出缺少的内容，因为它说模板无效。

看起来错误与范围有关，但不确定到底发生了什么：

New-AzManagementGroupDeployment : 1:19:17 AM - The deployment 'cis1.23-azurepolicy' failed with error(s). Showing 1 out of 1 error(s).
Status Message: Unable to process template language expressions for resource
'/providers/Microsoft.Management/managementGroups/MGName/providers/Microsoft.Authorization/policyDefinitions/CIS1.23-EnsureNoCustomerOwnerRoles' at line '23' and
column '9'. 'The deployment metadata 'SUBSCRIPTION' is not valid.' (Code:InvalidTemplate)

这是模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "effect": {
      "type": "string",
      "metadata": {
        "displayName": "Effect",
        "description": "Enable or disable the execution of the policy"
      },
      "allowedValues": [
        "Audit",
        "Disabled"
      ],
      "defaultValue": "Audit"
    }
  },
  "variables": {},
  "resources": [
    {
        "name": "CIS1.23-EnsureNoCustomerOwnerRoles",
      "type": "Microsoft.Authorization/policyDefinitions",
      "apiVersion": "2018-03-01",
      "properties": {
        "policyType": "Custom",
        "displayName": "CIS 1.23 Custom Owner Roles should not exist (Not Scored)",
        "description": "This policy checks that Custom Roles with Owner privileges are removed",
        "mode": "all",
        "metadata": {
          "category": "Identity"
          
        },
        "parameters": {
          "effect": {
            "type": "String",
            "metadata": {
              "displayName": "Effect",
              "description": "Enable or disable the execution of the policy"
            },
            "allowedValues": [
              "Audit",
              "Disabled"
            ],
            "defaultValue": "Audit"
          }
        
        },
        "policyRule": {
          "if": {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Authorization/roleDefinitions"
              },
              {
                "field": "Microsoft.Authorization/roleDefinitions/type",
                "equals": "CustomRole"
              },
              {
                "anyOf": [
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/permissions[*].actions[*]",
                      "notEquals": "*"
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/permissions.actions[*]",
                      "notEquals": "*"
                    }
                  }
                ]
              },
              {
                "anyOf": [
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/assignableScopes[*]",
                      "notIn": [
                        "[concat(subscription().id,'/')]",
                        "[subscription().id]",
                        "/"
                      ]
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Authorization/roleDefinitions/assignableScopes[*]",
                      "notLike": "/providers/Microsoft.Management/*"
                    }
                  }
                ]
              }
            ]
          },
          "then": {
            "effect": "[parameters('effect')]"
          }
        }
      }
    }

Answer 1

您正在将 ARM 模板部署到管理组，但您引用的是 ARM 模板 subscription() 函数。 subscription() 函数仅在部署到订阅或资源组时有效。部署到管理组时，没有可以引用的订阅。

要解决此问题，您需要将此策略部署到订阅，而不是管理组。

使用 powershell 部署 Azure Json 策略时出错

Error while deploying Azure Json policy using powershell

json

azure

arm-template

azure-policy