I am trying to create a Azure policy definition but getting error. This JSON code is taken from a built-in script from Azure policy "IP Forwarding on your virtual machine should be disabled" Below is my script
$Policy=
'{
"properties": {
"displayName": "Disable-IP-Forwarding",
"policyType": "Custom",
"mode": "All",
"description": "Disable-IP-Forwarding-Test.",
"metadata": {
"version": "1.0.1",
"category": "Security Center"
},
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"AuditIfNotExists",
"Disabled"
],
"defaultValue": "AuditIfNotExists"
}
},
"policyRule": {
"if": {
"field": "type",
"in": [
"Microsoft.Compute/virtualMachines",
"Microsoft.ClassicCompute/virtualMachines"
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Security/complianceResults",
"name": "disableIPForwarding",
"existenceCondition": {
"field": "Microsoft.Security/complianceResults/resourceStatus",
"in": [
"Monitored",
"OffByPolicy",
"Healthy"
]
}
}
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/Disable-IP-Forwarding",
"type": "Microsoft.Authorization/policyDefinitions",
"name": "Disable-IP-Forwarding"
}'
$definition = New-AzPolicyDefinition -Name "Disable-IP-Forwarding" -Description "Disable-IP-Forwarding-Test." -Policy $Policy
Below are the pictures from Powershell showing error. 1 & 2
https://i.stack.imgur.com/Ttj4w.png https://i.stack.imgur.com/K0JCv.png
I also tried with removing single quotes in policy rule as in here(click Here)
**Error: After removing Single quote **
New-AzPolicyDefinition: InvalidPolicyRule: Failed to parse policy rule: 'Could not find member 'properties' on object of type 'PolicyRuleDefinition'. Path 'properties'.'. CorrelationId: 7e754d56-2e8e-4323-8650-ae620bb60573 At line:70 char:15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
As per the documentation , When you create the Policy definition using New-AzPolicyDefinition
PowerShell Command. Your policy definition should be in the below format:
{
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"AuditIfNotExists",
"Disabled"
],
"defaultValue": "AuditIfNotExists"
}
},
"policyRule": {
"if": {
"field": "type",
"in": [
"Microsoft.Compute/virtualMachines",
"Microsoft.ClassicCompute/virtualMachines"
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Security/complianceResults",
"name": "disableIPForwarding",
"existenceCondition": {
"field": "Microsoft.Security/complianceResults/resourceStatus",
"in": [
"Monitored",
"OffByPolicy",
"Healthy"
]
}
}
}
}
}
You can pass the description, mode, metadata, display name as the parameters in the command.
Another problem, removing the single quotes and passing "[parameters(effect)]"
, this will give you another error. So the best way to pass the policy definition is saving it in the json file and pass the path to the command.
$definition = New-AzPolicyDefinition -Name "Disable-IP-Forwarding" -Description "Disable-IP-Forwarding-Test." -Policy "D:\Learning\policy1.json"
I figured it out as per in below link, used a Here-String for the JSON body: [link] (powershell.org/2019/04/hear-hear-for-here-strings)
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.