Azure Policy配置：实现指定小写命名规则的问题求助

我需要用Azure Policy实现资源命名模式tstpaas-appName-Env-Serial，规则如下：

• tstpaas为固定字符串常量
• appname为3-5个字符的字符串
• env可选值为dev/ust/prd
• serial为三位数字
• 所有字符需为小写，示例：tstpaas-app-dev-001

目前已配置的Policy能匹配基本模式，但appname的3-5字符长度限制及全小写验证未生效，附上当前Policy配置及参数，请求解决问题。

当前Policy配置 #

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "in": "[parameters('allowedResourceTypes')]"
        },
        {
          "anyOf": [
            {
              "not": {
                "field": "name",
                "match": "[parameters('nameMatchPattern1')]"
              }
            },
            {
              "not": {
                "value": "[if(greaterOrEquals(length(field('name')), 18), substring(field('name'), 14, 3), 'not in allowed values')]",
                "in": "[parameters('allowedEnvironments')]"
              }
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "nameMatchPattern1": {
      "type": "String",
      "metadata": {
        "displayName": "nameMatchPattern1",
        "description": "Pattern to match for names. Cna include ? and # for digits and letters"
      }
    },
    "allowedResourceTypes": {
      "type": "Array",
      "metadata": {
        "displayName": "allowedResourceTypes",
        "description": "List of resource types, for which policy applies"
      }
    },
    "allowedEnvironments": {
      "type": "Array",
      "metadata": {
        "displayName": "Allowed Environments",
        "description": "The list of Environments"
      },
      "allowedValues": [
        "dev",
        "int",
        "uat",
        "prd"
      ]
    }
  }
}

nameMatchPattern1参数值 #

tstpaas-?????-???-###

问题分析与修复方案 #

问题根源 #

1. 原match模式中appname部分是固定5个?，无法匹配3-4字符的合法appname；
2. 缺少强制全小写的验证逻辑；
3. 环境值提取依赖固定字符串长度，当appname长度变化时会定位错误。

修复后的Policy配置 #

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "in": "[parameters('allowedResourceTypes')]"
        },
        {
          "anyOf": [
            // 用正则表达式覆盖所有命名规则
            {
              "not": {
                "field": "name",
                "match": "^tstpaas-[a-z]{3,5}-(dev|ust|prd)-[0-9]{3}$"
              }
            },
            // 强制验证全小写
            {
              "not": {
                "field": "name",
                "equals": "[toLower(field('name'))]"
              }
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "allowedResourceTypes": {
      "type": "Array",
      "metadata": {
        "displayName": "允许的资源类型",
        "description": "策略适用的资源类型列表"
      }
    }
  }
}

修复说明 #

1. 正则表达式匹配：^tstpaas-[a-z]{3,5}-(dev|ust|prd)-[0-9]{3}$直接覆盖所有规则：
   • ^tstpaas-：匹配固定前缀
   • [a-z]{3,5}：匹配3-5个小写字母的appname
   • -(dev|ust|prd)-：匹配允许的环境值
   • [0-9]{3}$：匹配结尾的三位数字
2. 全小写验证：通过equals: "[toLower(field('name'))]"确保名称与自身小写形式一致，强制全小写；
3. 简化参数：移除冗余的nameMatchPattern1和allowedEnvironments参数，规则内联更清晰。

可选优化（保留参数灵活性） #

如果需要通过参数动态配置规则，可使用以下版本：

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "in": "[parameters('allowedResourceTypes')]"
        },
        {
          "anyOf": [
            {
              "not": {
                "field": "name",
                "match": "[concat('^tstpaas-[a-z]{', parameters('minAppNameLength'), ',', parameters('maxAppNameLength'), '}-(', join('|', parameters('allowedEnvironments')), ')-[0-9]{3}$')]"
              }
            },
            {
              "not": {
                "field": "name",
                "equals": "[toLower(field('name'))]"
              }
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "allowedResourceTypes": {
      "type": "Array",
      "metadata": {
        "displayName": "允许的资源类型",
        "description": "策略适用的资源类型列表"
      }
    },
    "minAppNameLength": {
      "type": "Integer",
      "metadata": {
        "displayName": "AppName最小长度",
        "description": "AppName允许的最小字符数"
      },
      "defaultValue": 3
    },
    "maxAppNameLength": {
      "type": "Integer",
      "metadata": {
        "displayName": "AppName最大长度",
        "description": "AppName允许的最大字符数"
      },
      "defaultValue": 5
    },
    "allowedEnvironments": {
      "type": "Array",
      "metadata": {
        "displayName": "允许的环境值",
        "description": "资源名称中允许的环境标识列表"
      },
      "allowedValues": [
        "dev",
        "ust",
        "prd"
      ],
      "defaultValue": ["dev", "ust", "prd"]
    }
  }
}

内容的提问来源于stack exchange，提问作者Durga Prasad B