如何配置Azure Policy仅针对特定名称子网启用私有端点路由表策略

可以实现仅针对特定名称（如snet-plink）的子网修改privateEndpointNetworkPolicies配置，核心是利用Azure Policy的where子句筛选目标子网，结合条件判断缩小作用范围。

修改后的完整Policy代码 #

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "Microsoft.Network/virtualNetworks/subnets[*].name",
          "contains": "snet-plink"
        },
        {
          "field": "Microsoft.Network/virtualNetworks/subnets[*].privateEndpointNetworkPolicies",
          "notIn": [
            "RouteTableEnabled",
            "Enabled"
          ],
          "where": {
            "field": "Microsoft.Network/virtualNetworks/subnets[*].name",
            "contains": "snet-plink"
          }
        }
      ]
    },
    "then": {
      "effect": "modify",
      "details": {
        "roleDefinitionIds": [
          "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
        ],
        "operations": [
          {
            "operation": "addOrReplace",
            "field": "Microsoft.Network/virtualNetworks/subnets[*].privateEndpointNetworkPolicies",
            "value": "RouteTableEnabled",
            "where": {
              "field": "Microsoft.Network/virtualNetworks/subnets[*].name",
              "contains": "snet-plink"
            }
          }
        ]
      }
    }
  },
  "parameters": {}
}

关键配置说明 #

1. 条件筛选

   • 第一个条件确认虚拟网络下存在名称包含snet-plink的子网
   • 第二个条件仅检查上述符合名称要求的子网，判断其privateEndpointNetworkPolicies是否未配置为目标值
   • 若需精确匹配子网名称，将contains替换为equals即可

2. Modify操作精准定位

   • 在operations中添加where子句，确保仅修改名称符合要求的子网，避免误操作其他子网

内容的提问来源于stack exchange，提问作者Mike Guy