Azure Firewall Policy规则集合循环部署数组索引报错咨询

问题场景 #

• 部署目标：已启用策略功能的Azure Firewall Premium，需要批量添加大量网络规则集合
• 实现思路：将所有规则集合定义在参数文件中，通过Bicep遍历参数项，逐一添加到防火墙策略内

参数文件结构 #

参数文件中FirewallSettings的配置结构如下：

"FirewallSettings": {
  "value": {
    "firewallPrefix": "efw",
    "numberOfPublicIPAddresses": 2,
    "threatIntelMode": "Deny",
    "networkRuleCollections": [
      {
        "name": "allowPing",
        "priority": 200,
        "type": "Allow",
        "rules": [
          {
            "name": "Ping",
            "protocols": ["ICMP"],
            "sourceAddresses": ["*"],
            "destinationAddresses": ["*"],
            "sourceIpGroups": [],
            "destinationIpGroups": [],
            "destinationFqdns": [],
            "destinationPorts": ["*"]
          }
        ]
      },
      {
        "name": "allowEventHub",
        "priority": 301,
        "type": "Allow",
        "rules": [
          {
            "name": "eventHubOut",
            "protocols": ["TCP"],
            "sourceAddresses": ["10.4.1.4"],
            "destinationAddresses": ["*"],
            "sourceIpGroups": [],
            "destinationIpGroups": [],
            "destinationFqdns": [],
            "destinationPorts": ["*"]
          }
        ]
      }
      // 其余规则集合省略
    ]
  }
}

原有问题代码 #

最初编写的Bicep遍历逻辑如下：

resource networkRules 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-08-01' = {
  name: 'firewallNetworkPolicies'
  parent: azureFirewallPolicy
  properties: {
    priority: 100
    ruleCollections: [for i in range(0, length(firewallSettings.networkRuleCollections)): {
        name: '${firewallSettings.networkRuleCollections[i].name}'
        priority: '${firewallSettings.networkRuleCollections[i].priority}'
        ruleCollectionType: 'NetworkRule'
        destinationAddresses: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationAddresses}'
        ]
        destinationFqdns: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationFqdns}'
        ]
        destinationIpGroups: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationIpGroups}'
        ]
        destinationPorts: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationPorts}'
        ]
        ipProtocols: [
          '${firewallSettings.networkRuleCollections[i].rules.protocols}'
        ]
        sourceAddresses: [
          '${firewallSettings.networkRuleCollections[i].rules.sourceAddresses}'
        ]
        sourceIpGroups: [
          '${firewallSettings.networkRuleCollections[i].rules.sourceIpGroups}'
        ]
      }]
  }
}

报错信息 #

部署时模板抛出错误：
The language expression property 'destinationAddresses' has an invalid array index

错误原因 #

报错由三个核心问题导致：

1. 数组引用层级错误：networkRuleCollections[i].rules本身是数组类型（单个规则集合下可包含多条规则），直接通过rules.destinationAddresses读取属性时没有指定规则项的索引，触发无效数组索引错误
2. 资源结构不符合API要求：网络规则集合需要通过action字段定义允许/拒绝动作，所有规则配置必须放在rules数组下，不能把单条规则的属性直接平铺到规则集合层级
3. 类型处理错误：priority是整数类型，协议、地址、端口等字段本身就是数组，不需要额外用字符串插值包裹转成字符串，也不需要额外套一层数组

修正方案 #

使用修正后的Bicep代码即可正常部署：

resource networkRules 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-08-01' = {
  name: 'firewallNetworkPolicies'
  parent: azureFirewallPolicy
  properties: {
    priority: 100
    ruleCollections: [for collection in firewallSettings.networkRuleCollections: {
      name: collection.name
      priority: collection.priority
      ruleCollectionType: 'NetworkRule'
      action: {
        type: collection.type
      }
      rules: [for rule in collection.rules: {
        name: rule.name
        ipProtocols: rule.protocols
        sourceAddresses: rule.sourceAddresses
        sourceIpGroups: rule.sourceIpGroups
        destinationAddresses: rule.destinationAddresses
        destinationIpGroups: rule.destinationIpGroups
        destinationFqdns: rule.destinationFqdns
        destinationPorts: rule.destinationPorts
      }]
    }]
  }
}

关键修正点 #

• 改用for item in array的直接遍历语法替代range+索引的写法，减少索引引用错误，代码可读性更高
• 补全缺失的action配置，映射参数中每个规则集合的Allow/Deny动作
• 新增第二层遍历逻辑，逐个读取规则集合下的每一条规则配置，匹配rules字段的数组结构
• 移除所有不必要的字符串插值，整数、数组类型的参数直接传递即可，无需额外类型转换
• 调整属性层级：将协议、源地址、目标地址、端口等规则属性全部放到rules数组的子项中，完全匹配Azure资源管理器的API结构要求

内容的提问来源于stack exchange，提问作者JacksWastedLife