Azure策略将额外资源报告为不符合要求

Question

我从以下位置复制了示例：https://github.com/Azure/azure-policy/blob/master/samples/Network/no-route-table-in-ER-Network/azurepolicy.rules.json，并尝试创建拒绝没有NSG的子网的策略。

{
   "if": {
      "anyOf": [
         {
            "allOf": [
               {
                  "field": "type",
                  "equals": "Microsoft.Network/virtualNetworks"
               },
               {

                     "field": "Microsoft.Network/virtualNetworks/subnets[*].networkSecurityGroup.id",
                     "exists": false

               }
            ]
         },
         {
            "allOf": [
               {
                  "field": "type",
                  "equals": "Microsoft.Network/virtualNetworks/subnets"
               },
               {
                  "field": "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id",
                  "exists": false
               }
            ]
         }
      ]
   },
   "then": {
      "effect": "deny"
   }
}

策略工作正常，在不分配NSG和从子网中删除NSG的情况下停止创建子网。但是，它也会将虚拟网络报告为不兼容，即使虚拟网络也可以。如何将此策略设置为只报告子网而不报告虚拟网络？

Answer 1

我设法通过稍微改变一下逻辑来让它工作起来：

{
  "if": {
    "anyOf": [
      {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks"
          },
          {
            "not": {
              "field": "Microsoft.Network/virtualNetworks/subnets[*].networkSecurityGroup.id",
              "exists": true
            }
          }
        ]
      },
      {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks/subnets"
          },
          {
            "not": {
              "field": "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id",
              "exists": true
            }
          }
        ]
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}