azure - 如何在deployIfNotExists Azure 策略中引用资源名称？

Question

下面是一个示例 azure 策略 json，它会查看所有存储帐户并将 configureIfNotExists 将allowBlobPublicAccess 设置设置为 true。如何确保每个arm模板中的名称字段获取存储帐户资源的名称？

一些额外的上下文:模板函数 1似乎效果不太好。如果尝试使用resourceId().resourceName1，我会收到错误

InvalidTemplate Message Deployment template validation failed: 'Thetemplate resource '[resourceId().resourceName1]' at line '1' andcolumn '207' is not valid: Unable to evaluate template languagefunction 'resourceId': function requires at least '2' argument(s)while '0' were provided. Please seehttps://aka.ms/arm-template-expressions/#resourceid for usagedetails.. Please see https://aka.ms/arm-template-expressions for usagedetails.'.

{
      "mode": "All",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            }
          ]
        },
        "then": {
          "effect": "deployIfNotExists",
          "details": {
            "type": "Microsoft.Storage/storageAccounts",
            "existenceCondition": {
              "allOf": [
                {
                  "field": "Microsoft.Storage/storageAccounts/allowBlobPublicAccess",
                  "equals": "true"
                }
              ]
            },
            "roleDefinitionIds": [
              "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ],
            "deployment": {
              "properties": {
                "mode": "incremental",
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "resources": [
                    {
                      "type": "Microsoft.Storage/storageAccounts",
                      "name": **"[resourceId().name]",**
                      "apiVersion": "2022-03-01",
                      "location": "canadacentral",
                      "properties": {
                         "allowBlobPublicAccess": "true"
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      },
      "parameters": {}
    }

Answer 1

您可以使用该功能

field(fieldName)

访问当前评估资源的属性。这是来自official docs :

field(fieldName)fieldName: [Required] string - Name of the field to retrieveReturns the value of that field from the resource that is being evaluated by the If condition.field is primarily used with AuditIfNotExists and DeployIfNotExists to reference fields on the resource that are being evaluated. An example of this use can be seen in the DeployIfNotExists example.

您可以查看示例deployIfNotExists 策略 here .