如何通过Terraform使用Azure内置策略？现有代码报错需排查

我想通过Terraform使用Azure内置策略，但只找到自定义策略的代码，自己编写了以下代码后运行报错，请求确认代码正确性并解决问题：

我的Terraform代码 #

provider "azurerm" {
  skip_provider_registration = "true"

  version = "3.0.1"

  features {}
}


resource "azurerm_resource_policy_assignment" "auditvms" { 
  name = "audit-vm-manageddisks"

  resource_id = "/subscriptions/sub_id/resourceGroups/rg-prod-hub"

  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d"

  description = "Shows all virtual machines not using managed disks"

  display_name = "Audit VMs without managed disks assignment" 
}

报错信息 #

Error : │ Error: ID cannot be a Resource Group ID
│ 
│   with azurerm_resource_policy_assignment.auditvms,
│   on main.tf line 11, in resource "azurerm_resource_policy_assignment" "auditvms":
│   11:  resource_id = "/subscriptions/sub_id/resourceGroups/rg-prod-hub"

问题原因及解决方案 #

错误原因 #

azurerm_resource_policy_assignment 是针对单个Azure资源（比如单台VM、单个存储账户）的策略分配资源，不支持传入资源组ID。要给资源组层级分配策略，必须使用专门的azurerm_resource_group_policy_assignment资源类型。

修正后的代码 #

替换资源类型即可，你的内置策略ID是正确的（对应Azure官方的「Audit VMs without managed disks」策略），修正后代码如下：

provider "azurerm" {
  skip_provider_registration = "true"

  version = "3.0.1"

  features {}
}


resource "azurerm_resource_group_policy_assignment" "auditvms" { 
  name = "audit-vm-manageddisks"

  # 两种方式二选一：直接填资源组名称，或者保留resource_id
  resource_group_name = "rg-prod-hub"
  # resource_id = "/subscriptions/sub_id/resourceGroups/rg-prod-hub"

  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d"

  description = "Shows all virtual machines not using managed disks"

  display_name = "Audit VMs without managed disks assignment" 
}

补充说明 #

• 若需给整个订阅分配策略，使用azurerm_subscription_policy_assignment资源
• 给管理组分配策略则用azurerm_management_group_policy_assignment资源
• 记得将代码中的sub_id替换为你的实际订阅ID

内容的提问来源于stack exchange，提问作者jubojet