azure 政策如果条件，不能有2种资源类型？

Question

我正在编写一个简单的策略，如果它是 Azure PaaS SQL，并且在防火墙规则中具有公共(public) IP，它将进行评估。

{
    "mode": "All",
    "policyRule": {
        "if": {
            "allOf": [
                {
                    "field": "type",
                    "equals": "Microsoft.Sql/servers"
                },
                {
                    "allOf": [
                        {
                            "field": "Microsoft.Sql/servers/firewallRules/startIpAddress",
                            "equals": "xxx.xxx.xxx.xxx"
                        },
                        {
                            "field": "Microsoft.Sql/servers/firewallRules/endIpAddress",
                            "equals": "xxx.xxx.xxx.xxx"
                        }
                    ]
                }
            ]
        },
        "then": {
            "effect": "[parameters('effect')]"
            
    },
    "parameters": {
        "effect": {
            "type": "String",
            "metadata": {
                "displayName": "Effect",
                "description": "Enable or disable the execution of the policy"
            },
            "allowedValues": [
                "Disabled",
                "Audit"
            ],
            "defaultValue": "Audit"
        }
    }
}

我发现当我点击添加这个定义时，错误消息告诉我

Editing policy definition 'sql firewall audit' in 'RogerBlueprint' failed. 
The policy definition  targets multiple resource types, but the policy rule is authored in a way that makes the policy not applicable to the target resource types 'Microsoft.Sql/servers,Microsoft.Sql/servers/firewallRules'. 
This is because the policy rule has a condition that can never be satisfied by the target resource types. 
If an alias is used, please make sure that the alias gets evaluated against only the resource type it belongs to by adding a type condition before it, or split the policy into multiple ones to avoid targeting multiple resource types.

请问在IF条件下是不是不能同时使用两种资源类型？

Answer 1

确实如此 - 从 ARM 的角度来看 Microsoft.Sql/servers 和 Microsoft.Sql/servers/firewallRules 是两个不同的对象，即使有一个父对象<>子关系。

策略引擎的运行方式是一一扫描每个 ARM 组件。在你的例子中，它清楚地表明它不会成功，因为给定的对象不能是同一类型的两种类型。在底层，别名 Microsoft.Sql/servers/firewallRules 被识别为类型，而不是属性。

如果逻辑适用于给定范围内的所有服务器，那么您可以将策略集中在 Microsoft.Sql/servers/firewallRules 上:

{
    "mode": "All",
    "policyRule": {
        "if": {
            "allOf": [
                {
                    "field": "type",
                    "equals": "Microsoft.Sql/servers/firewallRules"
                },
                {
                    "allOf": [
                        {
                            "field": "Microsoft.Sql/servers/firewallRules/startIpAddress",
                            "equals": "xxx.xxx.xxx.xxx"
                        },
                        {
                            "field": "Microsoft.Sql/servers/firewallRules/endIpAddress",
                            "equals": "xxx.xxx.xxx.xxx"
                        }
                    ]
                }
            ]
        },
        "then": {
            "effect": "[parameters('effect')]"
            
    },
    "parameters": {
        "effect": {
            "type": "String",
            "metadata": {
                "displayName": "Effect",
                "description": "Enable or disable the execution of the policy"
            },
            "allowedValues": [
                "Disabled",
                "Audit"
            ],
            "defaultValue": "Audit"
        }
    }
}