我们如何为依赖资源定义 Azure 策略规则？答案

【问题标题】：How do we define azure policy rules for dependent resources?我们如何为依赖资源定义 Azure 策略规则？
【发布时间】：2020-10-19 21:42:44
【问题描述】：

鉴于此 ARM 模板：https://github.com/Azure/azure-quickstart-templates/blob/master/101-redis-cache/azuredeploy.json

我们如何强制在启用诊断设置的情况下部署 Redis 缓存？

只有在 Azure 团队提供适当别名的情况下才有可能吗？

Redis 缓存的当前别名集：

{
    "Microsoft.Cache/Redis/redisConfiguration": {
        "maxfragmentationmemory-reserved": "300",
        "maxmemory-reserved": "200",
        "maxmemory-delta": "200",
        "maxclients": "7500",
        "rdb-backup-enabled": "true",
        "rdb-backup-frequency": "60",
        "rdb-backup-max-snapshot-count": "1",
        "rdb-storage-connection-string": "DefaultEndpointsProtocol=https;AccountName=blobnubldepenclsstgwu2;AccountKey=[key hidden]"
    },
    "Microsoft.Cache/Redis/provisioningState": "Succeeded",
    "Microsoft.Cache/Redis/enableNonSslPort": false,
    "Microsoft.Cache/Redis/sku.capacity": 1,
    "Microsoft.Cache/Redis/redisVersion": "4.0.14",
    "Microsoft.Cache/Redis/sku.family": "P",
    "Microsoft.Cache/Redis/hostName": "rc-nuRed-epe-ncls-stg-wu2.redis.cache.windows.net",
    "Microsoft.Cache/Redis/sku.name": "Premium",
    "Microsoft.Cache/Redis/sslPort": 6380,
    "Microsoft.Cache/Redis/port": 6379,
    "Microsoft.Cache/Redis/sku": {
        "name": "Premium",
        "capacity": 1,
        "family": "P"
    },
    "Microsoft.Cache/Redis/subnetId": "/subscriptions/d0ee6b93-7d29-45db-aabf-784018016241/resourceGroups/rg-grp-epe-ncls-stg-wu2/providers/Microsoft.Network/virtualNetworks/AZ-BIZ-10.32.223.0-26/subnets/AZ-BIZ-10.32.223.16-28",
    "Microsoft.Cache/Redis/staticIP": "10.32.223.24",
    "Microsoft.Cache/Redis/minimumTlsVersion": "1.2",
    "Microsoft.Cache/Redis/shardCount": 2,
    "Microsoft.Cache/Redis/zones": [
        "3"
    ]
}

【问题讨论】：

标签： azure-policy

【解决方案1】：

您需要使用auditIfNotExists 或deployIfNotExists 策略。 auditIfNotExists 将让您开始了解如何在没有诊断设置的情况下检测资源，但是 deployIfNotExists 路由更复杂，需要更多关于您的特定应用程序才能解决。

"policyRule": {
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Cache/redis"
      }
    ]
  },
  "then": {
    "effect": "auditIfNotExists",
    "details": {
      "type": "Microsoft.Insights/diagnosticSettings",
      "existenceCondition": {
        "allOf": [              
          {
            "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
            "equals": "true"
          },
          {
            "field": "Microsoft.Insights/diagnosticSettings/metrics[*].retentionPolicy.enabled",
            "equals": "false"
          }
        ]
      }
    }
  }
}

请记住，截至今天（2020 年 10 月 20 日），Redis 没有任何“日志”选项像下面这样

"existenceCondition": {
        "allOf": [
          {
            "field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
            "equals": "true"
          },
          {
            "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
            "equals": "false"
          },
          {
            "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
            "equals": "true"
          },
          {
            "field": "Microsoft.Insights/diagnosticSettings/metrics[*].retentionPolicy.enabled",
            "equals": "false"
          }
        ]
      }
    }

这应该让您能够审核诊断日志。如果要创建补救措施，则需要将 roleDefinition 和 deployment 添加到策略中，并将效果更改为 deployIfNotExists。只是一个警告，诊断设置可能很难修复，因为它们还需要存在存储帐户、事件中心或其他资源。如果这已经存在并且可以静态定义，那么这个问题将变得更容易解决。但是，如果需要进行补救以动态配置这些支持基础设施，那么您还必须围绕基础设施名称的全球唯一性以及其他问题创建规则。

如果您打算走deployIfNotExists 路线，这里是“冰山一角”文档，您需要知道才能开始。 https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#deployifnotexists

【讨论】：