Azure Policy配置VM主机端加密遇InvalidPolicyRule错误求助

问题描述 #

尝试通过Azure Policy启用VM主机端加密时，收到400错误（错误码：InvalidPolicyRule），具体错误信息如下：

RESPONSE 400: 400 Bad Request
ERROR CODE: InvalidPolicyRule #

{
"error": {
"code": "InvalidPolicyRule",
"message": "Failed to parse policy rule: 'Could not find member 'Microsoft.Compute/virtualMachines/securityProfile.encryptionAtHost' on object of type 'ModifyEffectDetailsDefinition'. Path '['Microsoft.Compute/virtualMachines/securityProfile.encryptionAtHost']'.'."
}
}

当前使用的错误策略代码：

{
    "type": "Microsoft.Authorization/policyDefinitions",
    "apiVersion": "2021-06-01",
    "name": "Enable VM Encryption at host",
    "properties": {
      "displayName": "Enable VM encryption at host",
      "mode": "Indexed",
      "description": "This policy enables VM encryption at host.",
      "metadata": {
          "category": "Compute"
      },
      "parameters": {},
      "policyRule": {
          "if": {
              "allOf": [
                  {
                      "field": "type",
                      "equals": "Microsoft.Compute/virtualMachines"
                  },
                  {
                      "field": "Microsoft.Compute/virtualMachines/securityProfile.encryptionAtHost",
                      "notEquals": "true"
                  }
              ]
          },
          "then": {
              "effect": "[parameters('effect')]",
              "details": {
                  "Microsoft.Compute/virtualMachines/securityProfile.encryptionAtHost": "true"
              }
          }
      },
      "policyType": "Custom"
    }
  }

问题原因 #

使用Modify效果时，details字段的格式错误。对于Microsoft.Compute/virtualMachines资源，修改securityProfile.encryptionAtHost需要使用标准的operations数组结构，而非直接将完整属性路径作为键值对。

解决方案 #

修改策略规则的then.details部分，采用operations数组定义修改操作，同时添加权限角色ID确保策略有执行修改的权限。

修改后的正确策略代码：

{
    "type": "Microsoft.Authorization/policyDefinitions",
    "apiVersion": "2021-06-01",
    "name": "Enable-VM-EncryptionAtHost",
    "properties": {
        "displayName": "启用VM主机端加密",
        "mode": "Indexed",
        "description": "此策略强制启用虚拟机的主机端加密功能",
        "metadata": {
            "category": "Compute"
        },
        "parameters": {
            "effect": {
                "type": "String",
                "metadata": {
                    "displayName": "效果",
                    "description": "策略执行的效果，可选Audit/Modify/Deny"
                },
                "allowedValues": [
                    "Audit",
                    "Modify",
                    "Deny"
                ],
                "defaultValue": "Modify"
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Compute/virtualMachines"
                    },
                    {
                        "field": "Microsoft.Compute/virtualMachines/securityProfile.encryptionAtHost",
                        "notEquals": "true"
                    }
                ]
            },
            "then": {
                "effect": "[parameters('effect')]",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
                    ],
                    "operations": [
                        {
                            "operation": "addOrReplace",
                            "field": "Microsoft.Compute/virtualMachines/securityProfile.encryptionAtHost",
                            "value": true
                        }
                    ]
                }
            }
        },
        "policyType": "Custom"
    }
}

关键修改说明 #

• 修正details结构：改用operations数组定义修改操作，每个操作包含operation（此处用addOrReplace）、field（属性路径）和value（目标值），符合Azure Policy Modify效果的标准格式。
• 添加roleDefinitionIds：指定虚拟机参与者的内置角色ID，确保策略拥有修改VM属性的权限。
• 修复参数缺失问题：原策略引用了[parameters('effect')]但未定义该参数，补充了effect参数的可选值和默认值配置。
• 修正值类型：encryptionAtHost为布尔类型，直接设置为true而非字符串"true"。

内容的提问来源于stack exchange，提问作者Mattman5000