使用 Terraform 创建 Azure 策略

Question

我正在尝试使用 terraform 创建一个 azure 策略来为资源添加标签。 我希望所有资源都继承资源组标签。

我一直在这里和那里关注文档和示例，但我无法弄清楚如何在资源上分配标签。

我想我很接近，我不想在每一个资源中都写标签，这是不可持续的。

我的代码分为 3 个不同的文件：

主程序

terraform {
  
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "=3.37.0"
    }
    azuread = {
      source  = "hashicorp/azuread"
      version = "2.31.0"
    }
  }
}

provider "azurerm" {
    subscription_id = var.azure_subscription_id
    tenant_id = var.azure_tenant_id
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

#create azure resource group
resource "azurerm_resource_group" "rg" {
  name     = var.azure_rg_name
  location = var.azure_resource_group_location
  tags = {
    costcenter = var.azure_costcenter
    projectcode = var.azure_project_code
    environment = var.azure_env_code
    client = var.azure_client_code

  }
}
#Create azure storage account
resource "azurerm_storage_account" "sa" {
  name                     = lower("${var.azure_project_code}${var.azure_env_code}sa01")
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = var.azure_resource_group_location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

#Create container in previously created sa
resource "azurerm_storage_container" "ctnr2" {
  name                  = lower("${var.azure_project_code}${var.azure_env_code}tfstate01")
  storage_account_name  = azurerm_storage_account.sa.name
  container_access_type = "private"
}

#create azure policy definition
resource "azurerm_policy_definition" "az_pol_def" {
  name         = "Append a tag and its value to resources"
  policy_type  = "Custom"
  mode         = "Indexed"
  display_name = "Append a tag and its value to resources"

  metadata = jsonencode({
    "version" : "1.0.1",
    "category" : "Tags  "
    }
  )
  

  policy_rule = jsonencode({
      "if": {
        "field": "[concat('tags[', parameters('tagName'), ']')]",
        "exists": "false"
      },
      "then": {
        "effect": "append",
        "details": [
          {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "value": "[parameters('tagValue')]"
          }
        ]
      } 
  })
}
#assign azure policy created previously
resource "azurerm_resource_group_policy_assignment" "az_pol_assign" {
  name                 = "Append a tag and its value to resources"
  resource_group_id    = azurerm_resource_group.rg.id
  policy_definition_id = azurerm_policy_definition.az_pol_def.id

  parameters = jsonencode({
    "parameters": {
      "tagName": {
        "type": "String",
        "metadata": {
          "displayName": "Tag Name",
          "description": "Name of the tag, such as 'environment'"
        }
      },
      "tagValue": {
        "type": "String",
        "metadata": {
          "displayName": "Tag Value",
          "description": "Value of the tag, such as 'production'"
        }
      }
    },
  })
}

变量.tf

variable "azure_resource_group_location" {
  default = "west europe"
  description   = "Location of the resource group."
}

variable "azure_subscription_id" {
  type        = string
  description = "Azure Subscription Id"
}

variable "azure_tenant_id" {
  type        = string
  description = "Azure Tenant Id"
}

variable "azure_rg_name" {
  type        = string
  description = "Azure Resource Group Name"
}

variable "azure_costcenter" {
  type        = string
  description = "Azure Tag Cost Center"
}

variable "azure_client_code" {
  type        = string
  description = "Azure Tag Client"
}

variable "azure_project_code" {
  type        = string
  description = "Azure Tag Project Code"
}

variable "azure_env_code" {
  type        = string
  description = "Azure Tag Environment Code"
}

资源组名称.tfvars

#Azure tenant id
azure_tenant_id ="********-****-****-****-************"
#Azure subscription
azure_subscription_id = "********-****-****-****-************"
#Azure resource group location
azure_resource_group_location = "west europe"
#Azure RG name
azure_rg_name = "resource_group_name"
#Azure tag
azure_costcenter = "missions"
#Azure tag project code
azure_project_code = "test_project"
#Azure tag client code
azure_client_code = "leanne"
#Environement tag code :
azure_env_code="dev"

我知道“parameter_values”应该用于我的标签，但我不确定如何使用？

这是一条可能有帮助的错误消息。

任何帮助将非常感激。

提前致谢 ！

Answer 1

您在策略分配( az_pol_assign ) 中声明了策略参数。
相反，您应该在策略定义( az_pol_def ) 中声明参数。

然后，在您的策略分配中，您可以设置要作为参数传递的值：

#assign azure policy created previously
resource "azurerm_resource_group_policy_assignment" "az_pol_assign" {
  name                 = "Append a tag and its value to resources"
  resource_group_id    = azurerm_resource_group.rg.id
  policy_definition_id = azurerm_policy_definition.az_pol_def.id

  parameters = jsonencode({
    tagName = {
      value = "environment"
    },
    tagValue = {
      value = "production"
    }
  })
}

注意当您使用jsonencode()时，您不需要使用普通的 JSON，您可以使用更简单的 HashiCorp 配置语言 (HCL) 语法，就像我在示例中所做的那样。