azure - 二头肌 : policy remediation task complains about missing parameter

Question

下面是我的二头肌代码，用于创建和分配策略来检测没有诊断设置的 key 保管库。该策略具有 deployIfNotExists 设置。因此它也应该能够创建缺失的诊断设置。 (来自具有修复过程的门户)

targetScope = 'subscription'
param diagnosticSettingName string = 'kv-local-diag'
param location string = 'westus'

resource localWorkspace 'Microsoft.OperationalInsights/workspaces@2021-12-01-preview' existing = {
  scope: resourceGroup('myResourceGroup')
  name: 'la-demo-01'
}

resource kvPolicy 'Microsoft.Authorization/policyDefinitions@2020-09-01' = {
  name: 'bicepKvPolicy'
  properties: {
    displayName: 'Keyvault central diagnostics policy'
    description: 'DeployIfNotExists a when diagnostic is not available for the keyvault'
    policyType: 'Custom'
    mode: 'All'
    metadata: {
      category: 'Custom'
      source: 'Bicep'
      version: '0.1.0'
    }
    parameters: {}
    policyRule: {
      if: {
        allOf: [
          {
            field: 'type'
            equals: 'microsoft.keyvault/vaults'
          }
        ]
      }
      then: {
        effect: 'deployIfNotExists'
        details: {
          roleDefinitionIds: [
            '/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
          ]
          type: 'Microsoft.Insights/diagnosticSettings'
          existenceCondition: {
            allOf: [
              {
                field: 'Microsoft.Insights/diagnosticSettings/logs[*].category'
                equals: 'audit'
              }
            ]
          }
          deployment: {
            properties: {
              mode: 'incremental'
              template: {
                '$schema': 'https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#'
                contentVersion: '1.0.0.0'
                parameters: {
                  resourceName: {
                    type: 'String'
                    metadata: {
                      displayName: 'resourceName'
                      description: 'Name of the resource'
                    }
                  }
              }
                variables: {}
                resources: [
                  {
                    type: 'microsoft.keyvault/vaults/providers/diagnosticSettings'
                    apiVersion: '2021-05-01-preview'
                    name: diagnosticSettingName
                    scope: '[concat(parameters(\'resourceName\'),\'/Microsoft.Insights/\', \'-${diagnosticSettingName}\')]'
                    properties: {
                      workspaceId: localWorkspace.id
                      logs: [
                        {
                        category: 'AuditEvent'
                        categoryGroup: null
                        enabled: true
                        retentionPolicy: {
                          days: 90
                          enabled: true
                        }
                      }
                      ]
                      metrics: [
                        {
                        category: 'AllMetrics'
                        enabled: true
                        retentionPolicy: {
                          days: 90
                          enabled: true 
                        }
                        timeGrain: null
                      }
                    ]
                    }
                  }
                ]
              }
            }
              parameters: {
                resourceName: {
                  value: '[field(\'name\')]'
                }
              }
            }
          }
        }
      }
    }
  }


  resource bicepExampleAssignment 'Microsoft.Authorization/policyAssignments@2022-06-01' = {
    name: 'bicepExampleAssignment'
    location: location
    identity: {
      type: 'SystemAssigned'
    }
    properties: {
      displayName: 'KV diagnostic policy assignement'
      description: 'KV diagnostic policy assignment'
      enforcementMode: 'Default'
      metadata: {
        source: 'Bicep'
        version: '0.1.0'
      }
      policyDefinitionId: kvPolicy.id
      resourceSelectors: [
        {
          name: 'selector'
          selectors: [
            {
              kind: 'resourceType'
              in: [
                'microsoft.keyvault/vaults'
              ]
            }
          ]
        }
      ]
      nonComplianceMessages: [
        {
          message: 'Resource is not compliant with a DeployIfNotExists policy'
        }
      ]
    }
  }

  resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
    name: guid(bicepExampleAssignment.name, bicepExampleAssignment.type, subscription().subscriptionId)
    properties: {
      principalId: bicepExampleAssignment.identity.principalId
      roleDefinitionId: '/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' 
    }
  }

部署后，我可以看到我的策略已正确创建和分配。当我在 Azure 门户中创建修复任务时。另外，我可以看到该策略正在选择缺少诊断设置的 Key Vault。

在此阶段，我正在创建修复任务并期望该任务部署诊断设置。但是当我检查结果时，我可以看到任务失败并出现以下错误:详细信息代码无效模板消息部署模板验证失败:“未提供第“1”行和“223”列的模板参数“resourceName”的值。请参阅https://aka.ms/arm-create-parameter-file了解使用详情。'.

据我了解，资源创建操作提示未提供参数值 (resourceName)。但我希望修复任务能够自动从合规流程列出的资源中选择资源名称。

如果您能就我的二头肌模板中可能缺少/错误的内容提出建议，我将非常感激。

Answer 1

你的代码看起来很适合我。二头肌模板中的 Parameters 对象缺少一些大括号。检查它以确保您遵循正确的模板并且没有语法错误。

我修改了您的代码如下，它对我有用。

targetScope = 'subscription'
param  diagnosticSettingName  string = 'kv-local-diag'
param  location  string = 'westus'
resource  localWorkspace  'Microsoft.OperationalInsights/workspaces@2021-12-01-preview'  existing = {
scope: resourceGroup('myResourceGroup')
name: 'newws'
}
resource  kvPolicy  'Microsoft.Authorization/policyDefinitions@2020-09-01' = {
name: ''
properties: {
displayName: 'Keyvault central diagnostics policy'
description: ''
policyType: 'Custom'
mode: 'All'
metadata: {
category: 'Custom'
source: 'Bicep'
version: '0.1.0'
}
parameters: {}
policyRule: {
if: {
allOf: [
{
field: 'type'
equals: 'microsoft.keyvault/vaults'
     }
   ]
}
then: {
effect: 'deployIfNotExists'
details: {
roleDefinitionIds: [
'/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
]
type: 'Microsoft.Insights/diagnosticSettings'
existenceCondition: {
allOf: [
{
field: 'Microsoft.Insights/diagnosticSettings/logs[*].category'
equals: 'audit'
      }
  ]
}
deployment: {
properties: {
mode: 'incremental'
template: {
'$schema': 'https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#'
contentVersion: '1.0.0.0'
parameters: {
resourceName: {
type: 'String'
metadata: {
displayName: 'resourceName'
description: 'Name of the resource'
         }
     }
}
resources: [
{
type: 'Microsoft.Insights/diagnosticSettings'
name: 'efef'
apiVersion: '2017-05-01-preview'
properties: {
workspaceId: localWorkspace.id
logs: [
{
category: 'AuditEvent'
enabled: true
retentionPolicy: {
enabled: true
days: 30
         }
      }
   ]
  }
  }
]}
parameters: {
resourceName: {
value: [resourceId('Microsoft.KeyVault/vaults',  'name')]
          }
         }
      }
     }
    }
  }
}
}
}

使用以下 Az CLI 命令进行部署:

az bicep build --file <filename.bicep>
az deployment group create --name Deployment --resource-group <resourceGroup> --template-file <filename.bicep>

输出: