配置根租户组分配通知：azurerm_role_management_policy问题求助

你的配置无法触发审批请求通知的核心问题是未启用针对审批人的通知规则，同时存在语法错误。以下是具体调整方案：

关键修改点 #

• 启用approver_notifications块：这是PIM激活请求时向审批人发送通知的核心配置，之前被注释导致审批场景的通知未触发。
• 修正语法错误：原配置末尾多了一个闭合大括号，会导致Terraform执行失败。

修改后的完整配置 #

resource "azurerm_role_management_policy" "tenant_root_mgmt_grp_owner_role_mgmt_pol" {
  scope              = "/providers/Microsoft.Management/managementGroups/${var.mg_id}"
  role_definition_id = "/providers/Microsoft.Authorization/roleDefinitions/${var.roles["Owner"].id}"

  eligible_assignment_rules {
    expiration_required = false
  }

  active_assignment_rules {
    expiration_required   = false
    require_justification = false
  }

  activation_rules {
    maximum_duration                   = "PT8H"
    require_multifactor_authentication = true
    require_justification              = true
    require_ticket_info                = true
    require_approval                   = true
    approval_stage {
      primary_approver {
        object_id = var.groups["ad.azure.admins"].id
        type      = "Group"
      }
    }
  }

  notification_rules {
    # PIM角色激活请求触发的通知
    eligible_activations {
      # 通知请求激活的用户
      assignee_notifications {
        notification_level    = "All"
        default_recipients    = true
        additional_recipients = [var.pim_slack_email]
      }

      # 通知审批管理员（核心修改：启用此块）
      approver_notifications {
        notification_level    = "Critical"
        default_recipients    = true  # 包含配置的审批组（ad.azure.admins）
        additional_recipients = [var.pim_slack_email]  # 同时通知Slack频道邮箱
      }

      admin_notifications {
        notification_level    = "Critical"
        default_recipients    = false
        additional_recipients = [var.pim_slack_email]
      }
    }

    eligible_assignments {
      admin_notifications {
        notification_level    = "Critical"
        default_recipients    = false
        additional_recipients = [var.pim_slack_email]
      }
    }

    active_assignments {
      admin_notifications {
        notification_level    = "Critical"
        default_recipients    = false
        additional_recipients = [var.pim_slack_email]
      }
    }
  }
}

配置说明 #

• approver_notifications启用后，当用户提交PIM激活请求时，会同时发送通知给：
  • 配置的审批组（var.groups["ad.azure.admins"]）
  • Slack频道对应的邮箱（var.pim_slack_email）
• notification_level设为Critical确保审批人收到关键操作提醒，避免遗漏。

验证步骤 #

1. 部署修改后的Terraform配置：执行terraform apply
2. 测试PIM激活请求：使用有权限的用户提交Owner角色的激活申请
3. 检查Slack频道邮箱和审批组成员的收件箱，确认是否收到通知

内容的提问来源于stack exchange，提问作者Kaushik Ray