ARM模板中创建策略实现Azure密钥库软删除与清除保护强制

我正尝试创建一条策略，强制Azure密钥库（Azure Key-Vaults）同时启用soft-deletion和purge-protection。当前存在软删除已启用或未启用、清除保护均未启用的密钥库，请问能否在同一个ARM模板中实现该需求？示例代码如下：

{
  "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
  "equals": "true"
},
OR (How to do this?)
{
  "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
  "exists": "false"
},
{
  "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
  "exists": "false"
}

可以在同一个ARM模板中实现这个需求，核心是利用Azure Policy的逻辑运算符（OR、AND）正确组合条件，并通过Modify效果自动修正密钥库配置。

完整ARM模板示例 #

{
  "$schema": "http://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Authorization/policyDefinitions",
      "name": "Enforce-KeyVault-SoftDelete-PurgeProtection",
      "apiVersion": "2021-06-01",
      "properties": {
        "displayName": "强制Azure密钥库启用软删除和清除保护",
        "description": "确保所有Azure密钥库同时启用软删除和清除保护，对未配置的密钥库自动修正",
        "mode": "Indexed",
        "policyRule": {
          "if": {
            "or": [
              {
                "and": [
                  {
                    "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
                    "equals": "true"
                  },
                  {
                    "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
                    "exists": false
                  }
                ]
              },
              {
                "and": [
                  {
                    "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
                    "exists": false
                  },
                  {
                    "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
                    "exists": false
                  }
                ]
              }
            ]
          },
          "then": {
            "effect": "modify",
            "details": {
              "roleDefinitionIds": [
                "/providers/Microsoft.Authorization/roleDefinitions/930048d0-7801-4291-83b6-3326cdc3e05a"
              ],
              "operations": [
                {
                  "operation": "addOrReplace",
                  "field": "Microsoft.KeyVault/vaults/enableSoftDelete",
                  "value": true
                },
                {
                  "operation": "addOrReplace",
                  "field": "Microsoft.KeyVault/vaults/enablePurgeProtection",
                  "value": true
                }
              ]
            }
          }
        }
      }
    }
  ]
}

关键逻辑说明 #

• 条件组合：用OR包含两组AND条件，精准匹配你提到的两类密钥库状态：
  1. 软删除已启用，但清除保护未配置
  2. 软删除未配置（字段不存在），且清除保护未配置
• 修正操作：通过modify效果的addOrReplace操作，强制为符合条件的密钥库开启软删除和清除保护
• 权限配置：roleDefinitionIds中填写的是密钥库参与者角色的默认ID，若使用自定义角色，替换为对应角色ID即可

内容的提问来源于stack exchange，提问作者Abhishek Rai