如何通过Terraform为Azure策略分配多个豁免

你可以通过Terraform的azurerm_policy_exemption资源，为已分配的ISO 27001计划添加单个策略豁免。以下是具体实现方式，包含单个豁免示例和批量创建5个豁免的优化方案：

1. 单个豁免的实现代码 #

在现有计划分配代码的基础上，添加如下azurerm_policy_exemption资源块，对应你提供的首个豁免需求：

data "azurerm_policy_set_definition" "iso27001" {
  display_name = "ISO 27001:2013"
}

resource "azurerm_resource_group_policy_assignment" "iso27001_assignment" {
  name                 = "iso27001_assignment"
  resource_group_id    = azurerm_resource_group.rg.id
  policy_definition_id = data.azurerm_policy_set_definition.iso27001.id
  description          = "Assignment of the ISO 27001:2013 initiative to subscription."
  display_name         = "ISO 27001:2013 Governance"
  location             = "Switzerland North"
  identity { 
    type = "SystemAssigned" 
  }
}

# 首个策略豁免
resource "azurerm_policy_exemption" "sql_aad_admin_exemption" {
  name                      = "sql-aad-admin-audit-exemption"
  policy_assignment_id      = azurerm_resource_group_policy_assignment.iso27001_assignment.id
  policy_definition_id      = "/providers/Microsoft.Authorization/policyDefinitions/1f314764-cb73-4fc9-b863-8eca98ac36e9"
  exemption_category        = "Waiver" # 可选值：Waiver/Mitigated，根据实际豁免原因选择
  display_name              = "豁免：SQL服务器Azure AD管理员审核策略"
  description               = "豁免审核为SQL服务器配置Azure Active Directory管理员的策略"
  scope                     = azurerm_resource_group.rg.id
}

2. 批量创建5个豁免的优化方案 #

如果需要添加5个豁免，推荐使用for_each批量创建，避免重复编写资源块：

data "azurerm_policy_set_definition" "iso27001" {
  display_name = "ISO 27001:2013"
}

resource "azurerm_resource_group_policy_assignment" "iso27001_assignment" {
  name                 = "iso27001_assignment"
  resource_group_id    = azurerm_resource_group.rg.id
  policy_definition_id = data.azurerm_policy_set_definition.iso27001.id
  description          = "Assignment of the ISO 27001:2013 initiative to subscription."
  display_name         = "ISO 27001:2013 Governance"
  location             = "Switzerland North"
  identity { 
    type = "SystemAssigned" 
  }
}

# 定义所有需要豁免的策略信息
locals {
  policy_exemptions = {
    sql_aad_admin = {
      policy_id   = "/providers/Microsoft.Authorization/policyDefinitions/1f314764-cb73-4fc9-b863-8eca98ac36e9"
      display_name = "豁免：SQL服务器Azure AD管理员审核策略"
      description  = "豁免审核为SQL服务器配置Azure Active Directory管理员的策略"
    },
    # 补充剩余4个豁免的信息，格式同上
    policy_2 = {
      policy_id   = "第二个策略的定义ID"
      display_name = "第二个豁免的显示名称"
      description  = "第二个豁免的描述"
    },
    policy_3 = {
      policy_id   = "第三个策略的定义ID"
      display_name = "第三个豁免的显示名称"
      description  = "第三个豁免的描述"
    },
    policy_4 = {
      policy_id   = "第四个策略的定义ID"
      display_name = "第四个豁免的显示名称"
      description  = "第四个豁免的描述"
    },
    policy_5 = {
      policy_id   = "第五个策略的定义ID"
      display_name = "第五个豁免的显示名称"
      description  = "第五个豁免的描述"
    }
  }
}

# 批量创建豁免
resource "azurerm_policy_exemption" "iso27001_exemptions" {
  for_each                  = local.policy_exemptions
  name                      = "${each.key}-exemption"
  policy_assignment_id      = azurerm_resource_group_policy_assignment.iso27001_assignment.id
  policy_definition_id      = each.value.policy_id
  exemption_category        = "Waiver"
  display_name              = each.value.display_name
  description               = each.value.description
  scope                     = azurerm_resource_group.rg.id
}

关键字段说明 #

• policy_assignment_id：关联你之前创建的ISO 27001计划分配的ID，确保豁免针对该计划分配生效
• policy_definition_id：填入需要豁免的单个策略的定义ID（即你提供的定义ID字段值）
• exemption_category：选择Waiver（豁免）或Mitigated（已缓解），根据实际业务场景决定
• scope：必须与计划分配的作用域一致（此处为资源组ID）

内容的提问来源于stack exchange，提问作者Tobi