PowerShell创建Azure Policy Definition报错及标签分配需求

错误根源是你的AuditStorageAccounts.json文件存在语法问题，最外层缺少包裹整个规则的大括号，导致PowerShell无法正确解析Policy规则。

修正后的完整JSON内容如下：

{
    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.Storage/storageAccounts"
            },
            {
                "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
                "equals": "Allow"
            }
        ]
    },
    "then": {
        "effect": "audit"
    }
}

将以上内容替换原文件后，重新运行你的PowerShell命令即可成功创建Policy Definition。

以下是两种实现方式：

方式1：使用外部JSON文件 #

1. 创建标签分配的Policy规则文件（例如AssignDepartmentTag.json）：

{
    "if": {
        "allOf": [
            {
                "field": "type",
                "notEquals": "Microsoft.Resources/subscriptions"
            },
            {
                "field": "tags['Department']",
                "exists": false
            }
        ]
    },
    "then": {
        "effect": "modify",
        "details": {
            "operations": [
                {
                    "operation": "add",
                    "field": "tags['Department']",
                    "value": "ITDepartment"
                }
            ],
            "roleDefinitionIds": [
                "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ]
        }
    }
}

2. 运行PowerShell命令创建Policy Definition：

New-AzPolicyDefinition -Name 'AssignDepartmentTag' `
    -DisplayName 'Assign Department tag to resources' `
    -Description 'Automatically assigns a Department tag to resources without it' `
    -Policy 'AssignDepartmentTag.json'

方式2：直接嵌入JSON内容到PowerShell脚本 #

无需外部文件，直接在脚本中定义Policy规则：

$tagPolicyRule = @"
{
    "if": {
        "allOf": [
            {
                "field": "type",
                "notEquals": "Microsoft.Resources/subscriptions"
            },
            {
                "field": "tags['Environment']",
                "exists": false
            }
        ]
    },
    "then": {
        "effect": "modify",
        "details": {
            "operations": [
                {
                    "operation": "add",
                    "field": "tags['Environment']",
                    "value": "Production"
                }
            ],
            "roleDefinitionIds": [
                "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ]
        }
    }
}
"@

New-AzPolicyDefinition -Name 'AssignEnvironmentTag' `
    -DisplayName 'Assign Environment tag to resources' `
    -Description 'Automatically assigns an Environment tag to resources without it' `
    -Policy $tagPolicyRule

关键说明 #

• effect设为modify是实现自动添加标签的核心，该效果允许Policy修改资源属性
• roleDefinitionIds中的ID是Azure内置的资源策略参与者角色ID，用于赋予Policy执行修改操作所需的权限
• 你可以根据需求修改tags的键名和默认值，以及调整if条件中的资源范围

内容的提问来源于stack exchange，提问作者Selvam Subramani