New-AzPolicyDefinition 通过 PowerShell 创建 Azure 策略定义答案

【问题标题】：New-AzPolicyDefinition Creation of Azure policy definition through PowerShellNew-AzPolicyDefinition 通过 PowerShell 创建 Azure 策略定义
【发布时间】：2020-07-22 21:44:24
【问题描述】：

我正在尝试创建 Azure 策略定义，但出现错误。此 JSON 代码取自 Azure 策略“应禁用虚拟机上的 IP 转发”的内置脚本下面是我的脚本

$Policy=
'{
  "properties": {
    "displayName": "Disable-IP-Forwarding",
    "policyType": "Custom",
    "mode": "All",
    "description": "Disable-IP-Forwarding-Test.",
    "metadata": {
      "version": "1.0.1",
      "category": "Security Center"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.Compute/virtualMachines",
          "Microsoft.ClassicCompute/virtualMachines"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/complianceResults",
          "name": "disableIPForwarding",
          "existenceCondition": {
            "field": "Microsoft.Security/complianceResults/resourceStatus",
            "in": [
              "Monitored",
              "OffByPolicy",
              "Healthy"
            ]
          }
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/Disable-IP-Forwarding",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "Disable-IP-Forwarding"
}'

$definition = New-AzPolicyDefinition    -Name "Disable-IP-Forwarding"  -Description "Disable-IP-Forwarding-Test." -Policy $Policy

以下是 Powershell 显示错误的图片。1 & 2

https://i.stack.imgur.com/Ttj4w.png https://i.stack.imgur.com/K0JCv.png

我还尝试删除策略规则中的单引号，如 here(click Here)

**错误：删除单引号后**

New-AzPolicyDefinition：InvalidPolicyRule：无法解析策略规则：“在“PolicyRuleDefinition”类型的对象上找不到成员“属性”。路径'属性'。'。相关 ID：7e754d56-2e8e-4323-8650-ae620bb60573 在 line:70 char:15

... efinition = New-AzPolicyDefinition -Name "Disable-IP-Forwarding" ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : CloseError: (:) [New-AzPolicyDefinition], ErrorResponseMessageException
- FullyQualifiedErrorId：Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzurePolicyDefinitionCmdlet

【问题讨论】：

标签： json powershell azure-policy

【解决方案1】：

根据documentation，当您使用New-AzPolicyDefinition PowerShell 命令创建策略定义时。您的政策定义应采用以下格式：

{
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.Compute/virtualMachines",
          "Microsoft.ClassicCompute/virtualMachines"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/complianceResults",
          "name": "disableIPForwarding",
          "existenceCondition": {
            "field": "Microsoft.Security/complianceResults/resourceStatus",
            "in": [
              "Monitored",
              "OffByPolicy",
              "Healthy"
            ]
          }
        }
      }
    }
}

您可以将描述、模式、元数据、显示名称作为参数传递给命令。

另一个问题，删除单引号并传递"[parameters(effect)]"，这会给你另一个错误。所以传递策略定义的最好方法是保存在json文件中，并将路径传递给命令。

$definition = New-AzPolicyDefinition    -Name "Disable-IP-Forwarding"  -Description "Disable-IP-Forwarding-Test." -Policy "D:\Learning\policy1.json"

【讨论】：

谢谢，它成功了。但是，我正在进行一些自动化操作，我将无法存储文件，因此必须处理同一页面上的所有内容。如果可以在 PowerShell 编辑器本身上完成，您能否提出任何建议。
我按照下面的链接弄明白了，对 JSON 正文使用了 Here-String：[link] (powershell.org/2019/04/hear-hear-for-here-strings)
如果有用请标记为答案。由于错误与您发布的模板有关。

【解决方案2】：

我按照下面的链接弄清楚了，对 JSON 正文使用了 Here-String： [链接] (powershell.org/2019/04/hear-hear-for-here-strings)

【讨论】：