PowerShell脚本未显式调用资源却报TargetResourceNotFound错误求助

我的PowerShell脚本未显式调用任何特定资源，但执行时触发“ErrorCode: TargetResourceNotFound”错误，脚本如下：

$subs = Get-AzSubscription | Where-Object {$_.Name -like "*-NonProd"}
foreach ($sub in $subs)
{
Select-AzSubscription -SubscriptionId $sub.Id
$RGs = Get-AzResourceGroup | Where-Object {$_.ResourceGroupName -like "*Infra"} 
foreach ($RG in $RGs)
{
$NetworkWatchers = Get-AzNetworkWatcher
$NSGs = (Get-AzNetworkSecurityGroup).Id 
foreach ($NSG in $NSGs)
{
       foreach ($NetworkWatcher in $NetworkWatchers)
{ 
       $Status = Get-AzNetworkWatcherFlowLogStatus -NetworkWatcherName $NetworkWatcher.Name 
ResourceGroupName $RG.ResourceGroupName -TargetResourceId $NSG -Verbose
}
     if (($Status).Enabled -eq $true)
{
     Write-Output  "$NSG in $(($sub).Name) has FlowLogs Enabled" | Tee-Object -FilePath 'C:\Users\user1\downloads\Output.txt'  -Verbose -Append
}
     if (($Status).Enabled -ne $true)
{ 
    Write-Output  "$NSG in $(($sub).Name) does not have FlowLogs Enabled" | Tee-Object -FilePath 'C:\Users\user1\downloads\Output.txt'  -Verbose -Append 
   }
  }
 }
}

错误详情：提示找不到指定的NetworkWatcher资源，报错代码为TargetResourceNotFound。

核心问题1：NetworkWatcher的资源组参数错误 #

调用Get-AzNetworkWatcherFlowLogStatus时，你指定的ResourceGroupName是NSG所在的$RG.ResourceGroupName，但NetworkWatcher默认创建在系统资源组（如NetworkWatcherRG），并非你遍历的*Infra资源组，导致脚本找不到对应的NetworkWatcher实例。

核心问题2：未匹配NetworkWatcher与NSG的区域 #

流量日志要求NetworkWatcher必须和目标NSG处于同一区域，你当前遍历所有NetworkWatcher去查询每个NSG，跨区域的查询必然触发资源找不到的错误。

核心问题3：变量覆盖逻辑错误 #

内层循环中每次遍历NetworkWatcher都会覆盖$Status变量，最后判断时只会用最后一个NetworkWatcher的查询结果，逻辑完全错误。

$outputPath = 'C:\Users\user1\downloads\Output.txt'
# 可选：清空输出文件
if (Test-Path $outputPath) { Clear-Content $outputPath }

$subs = Get-AzSubscription | Where-Object {$_.Name -like "*-NonProd"}
foreach ($sub in $subs) {
    Select-AzSubscription -SubscriptionId $sub.Id -Verbose
    # 将NetworkWatcher按区域分组，方便后续匹配同区域NSG
    $networkWatchersByRegion = Get-AzNetworkWatcher | Group-Object -Property Location

    # 获取所有*Infra资源组下的NSG
    $RGs = Get-AzResourceGroup | Where-Object {$_.ResourceGroupName -like "*Infra"}
    foreach ($RG in $RGs) {
        $NSGs = Get-AzNetworkSecurityGroup -ResourceGroupName $RG.ResourceGroupName
        foreach ($NSG in $NSGs) {
            $nsgRegion = $NSG.Location
            # 找到与NSG同区域的NetworkWatcher
            $targetWatcherGroup = $networkWatchersByRegion | Where-Object {$_.Name -eq $nsgRegion}
            if (-not $targetWatcherGroup) {
                $msg = "订阅[$($sub.Name)]中的NSG [$($NSG.Id)] 所在区域[$nsgRegion]无NetworkWatcher实例"
                Write-Output $msg | Tee-Object -FilePath $outputPath -Append -Verbose
                continue
            }

            $watcher = $targetWatcherGroup.Group[0]
            try {
                $Status = Get-AzNetworkWatcherFlowLogStatus `
                    -NetworkWatcherName $watcher.Name `
                    -ResourceGroupName $watcher.ResourceGroupName `
                    -TargetResourceId $NSG.Id `
                    -ErrorAction Stop
                
                $msg = if ($Status.Enabled) {
                    "订阅[$($sub.Name)]中的NSG [$($NSG.Id)] 已启用FlowLogs"
                } else {
                    "订阅[$($sub.Name)]中的NSG [$($NSG.Id)] 未启用FlowLogs"
                }
                Write-Output $msg | Tee-Object -FilePath $outputPath -Append -Verbose
            } catch {
                $msg = "查询订阅[$($sub.Name)]中NSG [$($NSG.Id)] 状态失败: $($_.Exception.Message)"
                Write-Output $msg | Tee-Object -FilePath $outputPath -Append -Verbose
            }
        }
    }
}

修正点说明 #

1. 按区域匹配资源：先将NetworkWatcher按区域分组，仅查询与NSG同区域的实例，避免跨区域错误。
2. 使用正确的资源组：通过$watcher.ResourceGroupName获取NetworkWatcher自身的资源组，不再复用NSG的资源组参数。
3. 添加异常处理：用try/catch捕获查询异常，避免脚本中途中断。
4. 修复变量逻辑：每个NSG对应独立的查询结果，不再出现变量覆盖问题。

内容的提问来源于stack exchange，提问作者Tsholofelo