使用 Visual Studio 进行 Azure 策略部署

Question

我正在尝试在构建的允许位置使用Azure策略。

在我的 ARM 模板定义下方

{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"listOfAllowedLocations": {
"type": "Array"
}
},
"variables": {},
"resources": [{
"type": "Microsoft.Authorization/policyDefinitions",
"name": "Test",
"apiVersion": "2018-03-01",
"properties": {
"displayName": "Test allowed locations",
"policyType": "BuiltIn",
"description": "This policy enables you to restrict the locations your organization can specify when deploying resources. Use to enforce your geo-compliance requirements.",
"parameters": {
"listOfAllowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of locations that can be specified when deploying resources.",
"strongType": "location",
"displayName": "Allowed locations"
}
}
},
"policyRule": {
"if": {
"not": {
"field": "location",
"in": "[parameters('listOfAllowedLocations')]"
}
},
"then": {
"effect": "Deny"
}
}
}
}],
"outputs": {}
}

当我尝试使用Visual Studio部署选项部署它时，我遇到以下错误

{
"error": {
"code": "InvalidPolicyUri",
"message": "The policy request scope '/subscriptions/xxx/resourcegroups/Test' should be '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'."
}
}

如果有人能指导我使用Visual Studio部署策略的正确方法，我真的很感激。此模板在 VS 部署测试中成功后，稍后将进入 DevOps 发布管道。

Answer 1

我想通了。默认情况下，Visual Studio 使用资源组部署，这就是它不起作用的原因。我们需要使用 New-AzureRmDeployment 而不是 New-AzureRmResourceGroupDeployment。