azure - 如何使用 azure 策略 DeployIfNotExists 资源组？

Question

下面的示例代码。这是

1. 评估不正确
2. 未将资源组正确部署到所有订阅

我正在尝试部署一个将资源组部署到所有订阅的策略。

"policyRule": {
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Resources/subscriptions"
      }
    ]
  },
  "then": {
    "effect": "deployIfNotExists",
    "details": {
      "type": "Microsoft.Resources/resourceGroups",
      "evaluationDelay": "AfterProvisioning",
      "roleDefinitionIds": [
        "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
      ],
      "deployment": {
        "location": "canadacentral",
        "properties": {
          "mode": "incremental",
          "template": {
            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "parameters": {},
            "variables": {},
            "resources": [
              {
                "type": "Microsoft.Resources/resourceGroups",
                "apiVersion": "2021-04-01",
                "name": "myResourceGroup",
                "location": "canadacentral",
                "properties": {}
              }
            ]
          }
        }
      }
    }
  }
}

Answer 1

大致的内容

"policyRule": {
  "if": {
    "field": "type",
    "equals": "Microsoft.Resources/subscriptions"
  },
  "then": {
    "effect": "deployIfNotExists",
    "details": {
      "type": "Microsoft.Resources/Subscriptions/resourcegroups",
      "roleDefinitionIds": [
        "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
      ],
      "evaluationDelay": "AfterProvisioning",
      "existenceCondition": {
        "field": "name",
        "equals": "myResourceGroup"
      },
      "resourceGroupName": "myResourceGroup",
      "deploymentScope": "subscription",
      "deployment": {
        "location": "canadacentral",
        "properties": {
          "mode": "incremental",
          "template": {
            "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "parameters": {},
            "variables": {},
            "resources": [
              {
                "name": "myResourceGroup",
                "type": "Microsoft.Resources/resourceGroups",
                "apiVersion": "2019-10-01",
                "location": "canadacentral"
              }
            ],
            "outputs": {}
          }
        }
      }
    }
  }
}