Azure 策略 - 防止在未经身份验证的情况下创建应用程序服务

Question

我希望创建一项策略，防止在未启用身份验证的情况下创建应用服务(仅审核它们是不够的)。

以下策略可以正确识别未启用身份验证的现有资源:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "Microsoft.Web/sites/config/siteAuthEnabled",
          "equals": "false"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

但是，这并不妨碍它们首先被创建(通过 ARM 模板或通过门户)。

我怀疑这是因为未显式创建 Microsoft.Web/sites/config 资源。

有人知道这是否可行吗？

Answer 1

显然，Azure Policy 不支持 Microsoft.Web/sites/config/* 资源类型(Microsoft.Web/sites/config/web 除外)至此。

引用@camillemarie来自this类似的 GitHub 问题:

authSettings cannot be managed via policy at this time. In the interest of hiding secrets from users in the default Reader role, this resource provider doesn't expose secrets via GET calls (hence the null in /config/web, and lack of GET support for /config/authSettings).

This means that the existing Microsoft.Web/sites/config/siteAuthSettings.* aliases are invalid. We'll look into removing these, but we don't have a good deprecation story at the moment.

引用:

• Microsoft.Web/sites/config/siteAuthSettings.* aliases are not valid #264
• Azure Policy - Known Issues