Azure策略存储帐户保留策略未标记资源
我正在使用下面的代码监视存储帐户的保留策略。似乎我有正确的别名,但当我看到合规性报告时显示“0中100%合规”。版本控制和专用链接策略也存在同样的问题。我的存储帐户策略与这些类似,但它们实际上返回了目标存储帐户的数量,唯一的区别是它们没有像这些一样引用blob服务别名。谢谢你的回答Azure策略存储帐户保留策略未标记资源,azure,storage,account,retention,Azure,Storage,Account,Retention,我正在使用下面的代码监视存储帐户的保留策略。似乎我有正确的别名,但当我看到合规性报告时显示“0中100%合规”。版本控制和专用链接策略也存在同样的问题。我的存储帐户策略与这些类似,但它们实际上返回了目标存储帐户的数量,唯一的区别是它们没有像这些一样引用blob服务别名。谢谢你的回答 resource "azurerm_policy_definition" "sa-ensure-versioning-enabled-policy" { name
resource "azurerm_policy_definition" "sa-ensure-versioning-enabled-policy" {
name = "sa-ensure-versioning-enabled-policy-definition"
policy_type = "Custom"
mode = "All"
#management_group_name = var.management_group_name
display_name = "Ensure versioning enabled policy"
metadata = <<METADATA
{
"version": "1.0.0",
"category": "Storage"
}
METADATA
policy_rule = <<POLICY_RULE
{
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
{
"not": {
"field":"Microsoft.Storage/storageAccounts/blobServices/default.isVersioningEnabled",
"equals": "true"
}
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
}
POLICY_RULE
parameters = <<PARAMETERS
{
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
},
"allowedValues": [
"audit",
"deny",
"disabled"
],
"defaultValue": "audit"
}
}
PARAMETERS
}
resource "azurerm_policy_assignment" "sa-ensure-versioning-enabled-policy-assignment" {
name = "sa-ensure-versioning-enabled-policy-assignment"
scope = data.azurerm_subscription.current.id
policy_definition_id = azurerm_policy_definition.sa-ensure-versioning-enabled-policy.id
description = "Storage Account ensure delete retention policy."
display_name = "Ensure versioning enabled policy"
parameters = <<PARAMETERS
{
"effect": {
"value": "audit"
}
}
PARAMETERS
}
似乎Azure中存在此ia错误,记录在此处:。显然,Microsoft.Storage/storageAccounts/blobServices尚未运行。解决方案的预计到达时间为2020年9月,但该日期和之前的一些日期已经过去。任何引用Microsoft.Storage/storageAccounts/blobServices的策略也应使用以下代码工作。(删除保留、版本控制等) 现在可以使用以下策略执行此操作:
"mode": "All",
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
"then": {
"effect": "auditIfNotExists",
"details": {
"type": "Microsoft.Storage/storageAccounts/blobServices",
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
],
"existenceCondition": {
"field": "Microsoft.Storage/storageAccounts/blobServices/deleteRetentionPolicy.enabled",
"equals": "true"
}
}
}
},
"parameters": {}
}
我们可以确保通过Azure策略为blob启用软删除吗?现在,在RoleDefinitions的一点帮助下,可以做到这一点,请参阅上面的代码。
"mode": "All",
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
"then": {
"effect": "auditIfNotExists",
"details": {
"type": "Microsoft.Storage/storageAccounts/blobServices",
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
],
"existenceCondition": {
"field": "Microsoft.Storage/storageAccounts/blobServices/deleteRetentionPolicy.enabled",
"equals": "true"
}
}
}
},
"parameters": {}
}