使用 Terraform 强制执行标签及其价值 Azure Policy

Question

我试图强制用户添加标签及其值，在我的示例中，名称为“环境”，值为“生产”。但是在这里我的代码有问题，一个我无法解决的错误，这就是我在这里的原因。该错误涉及参数“tagValue”，他似乎没有被现有策略识别，这里是“azurerm_policy_definition”。提前感谢您的帮助。

variable "requiredTag" {
  default = "environment"
}

variable "requiredValue" {
  default = "production"
}

resource "azurerm_policy_assignment" "requiredTag" {
  name                 = "Deny-RequiredTag-${var.requiredTag}"
  display_name         = "Tag obligatoire '${var.requiredTag}'"
  description          = "Affectation de la stratégie de balise requise pour '${var.requiredTag}'"
  policy_definition_id = "${azurerm_policy_definition.requiredTag.id}"
  scope                = "/subscriptions/0000000000/resourceGroups/PolicyLab"
  parameters           = <<PARAMETERS
  {
    "tagValue": {
        "value": "${var.requiredValue}"
    },
    "tagName": {
        "value": "${var.requiredTag}"
    }
}
PARAMETERS
}

resource "azurerm_policy_definition" "requiredTag" {
  name         = "Deny-RequiredTag-Resource"
  display_name = "Deny a Required Tag on a Resource"
  description  = "Deny all resources for a required tag"
  policy_type  = "Custom"
  mode         = "All"
  policy_rule  = <<POLICY_RULE
  {
    "if": {
      "not": {
        "field": "[concat('tags[', parameters('tagName'), ']')]",
        "equals": "[parameters('tagValue')]"
      }
    },
    "then": {
        "effect": "deny"
    }
}
POLICY_RULE

  parameters   = <<PARAMETERS
  {
    "tagName": {
        "type": "String",
        "metadata": {
            "displayName": "Tag Name",
            "description": "Name of the tag, such as 'environment'"
        }
    },
    "tagValue": {
        "type": "String",
        "metadata": {
            "displayName": "Tag Value",
            "description": "Value of the tag, such as 'production'"
        }
    }
}
PARAMETERS

}

这是错误：

    Error: policy.DefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="InvalidPolicyParameterUpdate" Message="The policy contains new parameter(s) 'tagValue' which are not present in the existing policy and have no default value. New parameters may be added to a policy only if they have a default value."

  on main.tf line 34, in resource "azurerm_policy_definition" "requiredTag":
  34: resource "azurerm_policy_definition" "requiredTag" {

Answer 1

该策略包含新参数“tagValue”，这些参数不存在于现有策略中并且没有默认值。 仅当新参数具有默认值时，才能将新参数添加到策略中。

要么删除现有策略，要么为你的 terraform 脚本添加一个默认值。

    "tagValue": {
        "type": "String",
        "metadata": {
            "displayName": "Tag Value",
            "description": "Value of the tag, such as 'production'"
        },
        "defaultValue": [ "production" ]
    }