azure - 二头肌 : azure policy assignment scope

Question

我正在尝试使用 Bicep 部署 Azure 策略分配。

resource policy_assignment 'Microsoft.Authorization/policyAssignments@2021-06-01' = {
  name: 'my_policy'
  location: 'westus'
  scope: subscriptionResourceId('Microsoft.Resources/resourceGroups',  resourceGroup().name)
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '/subscriptions/xxxxxxx-xxxxxx-xxxx-xxx/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/mymi': {}
    }
  }
  properties: {
    parameters: {
      MyParamKey: '/subscriptions/xxxxx-xxx-xxxx-xxx-xxx/resourcegroups/my-rg2/providers/microsoft.network/virtualnetworks/vnetmy/subnets/default'
    }
    policyDefinitionId: '/subscriptions/xxxxx-xxx-xxxx-xxx-xxx//providers/Microsoft.Authorization/policyDefinitions/my-policy-def'
  }
}

当我使用 az bicep build --file .\policy_assignment.bicep 检查时，出现以下错误:

C:$Path.bicep(4,10) : Error BCP036: The property "scope" expected a value of type "resource | tenant" but the provided value is of type "string".
C:$Path.bicep(13,32) : Warning BCP036: The property "MyParamKey" expected a value of type "ParameterValuesValue" but the provided value is of type "'/subscriptions/xxxxx-xxx/resourcegroups/my-rg2/providers/microsoft.network/virtualnetworks/vnetmy/subnets/default'".

我有两个问题:

• 定义政策分配的范围。
• 赋值参数的定义

我在互联网上找不到太多例子。二头肌策略分配的文档是 here .

您知道如何纠正这些错误吗？

Answer 1

此资源类型很可能希望将参数值包装在具有 value 的对象中，例如:

parameters: {
  MyParamKey: {
    value: '/subscriptions/xxxxx-xxx-xxxx-xxx-xxx/resourcegroups/my-rg2/providers/microsoft.network/virtualnetworks/vnetmy/subnets/default'
  }
}

有some other use cases就像这个。

编辑:正如@Thomas所述，范围应称为scope:resourceGroup()，因为这是由您的客户端使用Bicep正在等待的正确类型动态检索的。