现有Azure Policy代码无效，求助开发Blob分层生命周期规则定义

原代码的问题在于只配置了转Cool层的规则，缺少Archive层转换逻辑，且未遵循管理策略的完整结构要求，导致无法生成有效策略。以下是两种可行的修正方案：

方案1：使用DeployIfNotExists（推荐） #

该方案会检查存储账户是否已存在目标生命周期规则，不存在则自动部署，且保留现有管理策略中的其他规则：

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        {
          "field": "kind",
          "equals": "BlobStorage"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/accessTier",
          "equals": "Hot"
        }
      ]
    },
    "then": {
      "effect": "deployIfNotExists",
      "details": {
        "type": "Microsoft.Storage/storageAccounts/managementPolicies",
        "name": "default",
        "existenceCondition": {
          "allOf": [
            {
              "field": "Microsoft.Storage/storageAccounts/managementPolicies/default.rules[*].name",
              "contains": "blobLifecycleTiering"
            }
          ]
        },
        "roleDefinitionIds": [
          "/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
        ],
        "deployment": {
          "properties": {
            "mode": "incremental",
            "template": {
              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
              "contentVersion": "1.0.0.0",
              "parameters": {
                "storageAccountName": {
                  "type": "string"
                }
              },
              "resources": [
                {
                  "type": "Microsoft.Storage/storageAccounts/managementPolicies",
                  "apiVersion": "2021-09-01",
                  "name": "[concat(parameters('storageAccountName'), '/default')]",
                  "properties": {
                    "policy": {
                      "rules": [
                        {
                          "enabled": true,
                          "name": "blobLifecycleTiering",
                          "type": "Lifecycle",
                          "definition": {
                            "actions": {
                              "baseBlob": {
                                "tierToCool": {
                                  "daysAfterModificationGreaterThan": 30
                                },
                                "tierToArchive": {
                                  "daysAfterModificationGreaterThan": 180
                                }
                              }
                            },
                            "filters": {
                              "blobTypes": [
                                "blockBlob"
                              ]
                            }
                          }
                        }
                      ]
                    }
                  }
                }
              ]
            },
            "parameters": {
              "storageAccountName": {
                "value": "[field('name')]"
              }
            }
          }
        }
      }
    }
  },
  "parameters": {}
}

关键说明： #

• Indexed模式：仅针对支持资源索引的存储账户类型，符合Azure Policy最佳实践
• existenceCondition：避免重复部署同名规则
• roleDefinitionIds：指定存储账户参与者角色，确保策略有足够权限配置管理策略
• 生命周期规则：同时配置30天转Cool、180天转Archive的动作，通过filters限定仅作用于块Blob（可按需调整）
• incremental部署模式：保留现有管理策略中的其他规则，仅新增目标分层规则

方案2：使用Append（直接追加规则） #

若需要直接将规则追加到现有管理策略中，可使用以下定义：

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        {
          "field": "kind",
          "equals": "BlobStorage"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/accessTier",
          "equals": "Hot"
        }
      ]
    },
    "then": {
      "effect": "append",
      "details": [
        {
          "field": "Microsoft.Storage/storageAccounts/managementPolicies",
          "value": {
            "rules": [
              {
                "enabled": true,
                "name": "blobLifecycleTiering",
                "type": "Lifecycle",
                "definition": {
                  "actions": {
                    "baseBlob": {
                      "tierToCool": {"daysAfterModificationGreaterThan": 30},
                      "tierToArchive": {"daysAfterModificationGreaterThan": 180}
                    }
                  },
                  "filters": {
                    "blobTypes": ["blockBlob"]
                  }
                }
              }
            ]
          }
        }
      ]
    }
  },
  "parameters": {}
}

注意事项： #

• 若存储账户已有同名规则，append操作可能导致冲突，需确保规则名称唯一
• 若存储账户无管理策略，该定义会直接创建包含目标规则的策略

内容的提问来源于stack exchange，提问作者Georgie