自定义Azure Policy继承资源组标签时出现重复字段报错

报错原因 #

报错信息：

"message":"The policy definition 'InheritTagsFromRGPolicy' rule is invalid. 
The policy effect details contains operations on duplicate fields in 'add' or 'addOrReplace' operations: 'tags[]'."

原Policy硬编码了固定5个标签索引，当传入的listOfTagNames参数长度不足5时，未定义的索引会返回空值，导致生成重复的tags[]字段操作，违反Azure Policy的modify操作规则。同时硬编码写法无法灵活适配任意数量的标签需求。

修复后的完整Policy定义 #

{
    "properties": {
        "displayName": "Inherit tags from Resource Group",
        "policyType": "Custom",
        "mode": "All",
        "description": "Adds specified tags with values from the parent resource group.",
        "metadata": {
            "version": "1.0.0",
            "category": "General"
        },
        "parameters": {
            "listOfTagNames": {
                "type": "Array",
                "metadata": {
                    "displayName": "Required Tags",
                    "description": "The list of tags to inherit from the resource group"
                }
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "notEquals": "Microsoft.Resources/subscriptions/resourceGroups"
                    },
                    {
                        "foreach": "[parameters('listOfTagNames')]",
                        "where": {
                            "allOf": [
                                {
                                    "field": "[concat('tags[', currentItem(), ']')]",
                                    "exists": "false"
                                },
                                {
                                    "value": "[resourceGroup().tags[currentItem()]]",
                                    "notEquals": ""
                                }
                            ]
                        }
                    }
                ]
            },
            "then": {
                "effect": "modify",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
                    ],
                    "operations": [
                        {
                            "foreach": "[parameters('listOfTagNames')]",
                            "operation": "add",
                            "field": "[concat('tags[', currentItem(), ']')]",
                            "value": "[resourceGroup().tags[currentItem()]]"
                        }
                    ]
                }
            }
        }
    }
}

关键改进说明 #

• 使用foreach遍历listOfTagNames参数，适配任意数量的标签，彻底避免硬编码索引导致的空字段重复问题
• 添加资源组类型排除逻辑，防止Policy应用到资源组自身引发不必要的逻辑冲突
• 通过currentItem()动态生成每个标签的判断和操作字段，确保每个modify操作的目标字段唯一，符合Azure Policy的规则

内容的提问来源于stack exchange，提问作者Ankita Pal