通过ARM脚本创建带网络配置的Azure容器应用遇策略阻止求助

问题现象 #

通过ARM自动化脚本创建带有自定义VNet配置的Azure Container App时部署失败，错误提示策略阻止了必要资源的创建；但不配置网络时可成功创建Container App。

错误详情 #

{
    "id": "/subscriptions/xxxx/resourceGroups/yyyy/providers/Microsoft.App/managedEnvironments/xxxxx",
    "name": "testcontainerappsenv",
    "type": "Microsoft.App/managedEnvironments",
    "location": "westeurope",
    "tags": {},
    "systemData": {
        "createdBy": "test@gmail.com",
        "createdByType": "User",
        "createdAt": "xxxx",
        "lastModifiedBy": "test@gmail.com",
        "lastModifiedByType": "User",
        "lastModifiedAt": "xxxx"
    },
    "properties": {
        "provisioningState": "Failed",
        "vnetConfiguration": {
            "internal": false,
            "infrastructureSubnetId": "/subscriptions/xxxx/resourceGroups/yyy/providers/Microsoft.Network/virtualNetworks/testvnt/subnets/aaaa",
            "dockerBridgeCidr": "10.1.0.1/16",
            "platformReservedCidr": "10.0.0.0/16",
            "platformReservedDnsIP": "10.0.0.2"
        },
        "deploymentErrors": "ErrorCode: ManagedEnvironmentResourceDisallowedByPolicy, Message: Fail to create managed environment because creation of required resources was disallowed by policy, refer to https://go.microsoft.com/fwlink/?linkid=2198255 for more detail.",
        "defaultDomain": "xxxxxx.westeurope.azurecontainerapps.io",
        "appLogsConfiguration": {
            "destination": "log-analytics",
            "logAnalyticsConfiguration": {
                "customerId": "xxxxxxxxxx"
            }
        }
    }
}

排查结果 #

阻止部署的Azure策略为：Subnets should be associated with a network security group（策略ID：/providers/Microsoft.Authorization/policyDefinitions/783ea2a8-b8fd-46be-896a-9ae79643a0b1）

解决指导 #

• 检查子网的NSG关联状态：确认ARM模板中指定的infrastructureSubnetId对应的子网已关联网络安全组（NSG）。若未关联，需为该子网创建或绑定现有NSG。
• 配置符合要求的NSG规则：确保关联的NSG包含Azure Container App环境运行所需的流量规则，比如允许Azure Container Apps服务的入站/出站流量、容器间通信流量等。
• 申请策略豁免（必要时）：若无法修改子网的NSG配置，可向Azure管理员申请针对该Container App环境所在资源组或目标子网的策略豁免，豁免范围应最小化以遵循安全原则。
• 验证ARM模板配置：再次核对模板中的VNet参数（如子网ID、CIDR段）是否正确，确保所有网络配置项符合Azure策略要求。

内容的提问来源于stack exchange，提问作者santosh kumar patro