使用Azure Resource Graph SDK .NET查询合规分数：调用及订阅获取求助

第一步：修正订阅ID传递错误 #

你当前代码里Subscriptions = { subscriptionIds.ToString() }是错误的，这会把列表的字符串标识（比如System.Collections.Generic.List1[System.String]`）当成单个订阅ID传入。正确做法是直接将所有订阅ID添加到集合：

var request = new ResourceQueryContent(query)
{
    Subscriptions = subscriptionIds
};

第二步：完成查询调用逻辑 #

通过ArmClient获取ResourceGraphClient，调用Resources.QueryAsync执行查询，完整的GetComplianceScoreAsync方法代码如下：

public async Task<QueryResponse> GetComplianceScoreAsync()
{
    var subscriptionIds = new List<string>();
    await foreach (var sub in _armClient.GetSubscriptions().GetAllAsync())
    {
        subscriptionIds.Add(sub.Data.SubscriptionId);
    }

    if (subscriptionIds.Count == 0)
    {
        throw new Exception("No subscriptions found.");
    }

    // 替换为按资源类型查询合规分数的Resource Graph语句
    var query = @"
        resources
        | where type =~ 'Microsoft.Compute/virtualMachines' // 示例：筛选虚拟机资源
        | join kind=leftouter (
            securityresources
            | where type =~ 'Microsoft.Security/complianceResults'
            | extend resourceId = tolower(properties.resourceId)
            | project resourceId, complianceState = properties.complianceState, score = properties.score
        ) on $left.id == $right.resourceId
        | project name, type, complianceState, score
    ";

    var request = new ResourceQueryContent(query)
    {
        Subscriptions = subscriptionIds
    };

    // 获取客户端并执行查询
    var resourceGraphClient = _armClient.GetResourceGraphClient();
    var response = await resourceGraphClient.Resources.QueryAsync(request);

    return response.Value;
}

第三步：关键注意事项 #

• 动态订阅获取：你当前的_armClient.GetSubscriptions().GetAllAsync()已经正确实现了动态获取租户下所有有权限的订阅，无需额外修改。
• 查询语句调整：示例查询关联了资源表与合规结果表，你可以根据需求修改type筛选条件、返回字段或添加更多过滤逻辑。
• 权限配置：确保服务主体（Client ID对应的身份）拥有Resource Graph Query Reader权限，以及目标订阅的Reader权限，否则无法获取订阅或合规数据。

第四步：控制器调用示例 #

在控制器中注入服务后直接调用方法：

[ApiController]
[Route("api/compliance")]
public class ComplianceController : ControllerBase
{
    private readonly ComplianceService _complianceService;

    public ComplianceController(ComplianceService complianceService)
    {
        _complianceService = complianceService;
    }

    [HttpGet("score")]
    public async Task<IActionResult> GetComplianceScore()
    {
        try
        {
            var result = await _complianceService.GetComplianceScoreAsync();
            return Ok(result);
        }
        catch (Exception ex)
        {
            return BadRequest(ex.Message);
        }
    }
}

内容的提问来源于stack exchange，提问作者Richi Sharma