azure - 奇怪的结果，根据现有的内置策略创建 Azure KeyVault 策略时出错-“字段”属性引用的提供程序不存在

问题描述

所以...我在将其中一个内置插件转换为自定义插件时遇到了一些困难。（我为什么要这样做？内部事务，我是否同意都无关紧要，所以请不要拒绝我的决定。:-)）

现有的内置策略：

https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Certificates_ValidityPeriod.json

问题出现在 json 文件的第 40/43 行。

main.tf 文件包括：

# policy
locals {
  json_keyvault_certmaxvalidityperiod = jsondecode(file("${path.module}/resourceprovider/KeyVault/Certificates should have the specified maximum validity period.json"))
}

resource "azurerm_policy_definition" "CertificatesShouldHaveSpecifiedMaximumValidityPeriod" {
  name         = "CertificatesShouldHaveSpecifiedMaximumValidityPeriod" # must match output.tf and ad ID to main
  policy_type  = "Custom"  #Must always be Custom
  mode         = "All"
  display_name = "CertificatesShouldHaveSpecifiedMaximumValidityPeriod" #add Custom to display name
  description  = "Manage your organizational compliance requirements by specifying the maximum amount of time that a certificate can be valid within your key vault."
  metadata     = jsonencode(local.json_keyvault_certmaxvalidityperiod.properties.metadata)
  policy_rule  = jsonencode(local.json_keyvault_certmaxvalidityperiod.properties.policyRule)
  parameters   = <<PARAMETERS
    {
        "effect" : {
            "type": "string",
            "metadata": {
                "description": "Enable or disable the execution of the policy",
                "displayName": "Effect"
            }
        },
        "maximumValidityInMonths": {
            "type": "integer",
            "metadata": {
                "description": "The limit to how long a certificate may be valid for. Certificates with lengthy validity periods aren\u0027t best practice.",
                "displayName": "The maximum validity in months"
            }
        }
    }
  PARAMETERS
}

按原样使用 json 内容，执行terraform apply返回：

│ Error: creating/updating Policy Definition "CertificatesShouldHaveSpecifiedMaximumValidityPeriod": policy.DefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="InvalidProviderNameInPolicyAlias" Message="The policy definition 'CertificatesShouldHaveSpecifiedMaximumValidityPeriod' rule is invalid. The provider 'Microsoft.KeyVault.Data' referenced by the 'field' property 'Microsoft.KeyVault.Data/vaults/certificates/properties.validityInMonths' of the policy rule doesn't exist."

因此，我查看了 Microsoft.KeyVault.Data 提供程序的定义，从以下内容来看，似乎不应该有“证书”，而应该是“秘密”：

https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/Certificates_ValidityPeriod.json

但是...如果我更新第 40/43 行以反映 Microsoft.KeyVault.Data/vaults/secrets，则terraform apply返回：

│ Error: creating/updating Policy Definition "CertificatesShouldHaveSpecifiedMaximumValidityPeriod": policy.DefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="InvalidProviderNameInPolicyAlias" Message="The policy definition 'CertificatesShouldHaveSpecifiedMaximumValidityPeriod' rule is invalid. The provider 'Microsoft.KeyVault.Data' referenced by the 'field' property 'Microsoft.KeyVault.Data/vaults/secrets/properties.validityInMonths' of the policy rule doesn't exist."

以前有没有人处理过这样的事情？关于如何定义策略规则以适应数据提供者的建议？

标签： azureazure-keyvaultazure-policy

azure - 奇怪的结果，根据现有的内置策略创建 Azure KeyVault 策略时出错-“字段”属性引用的提供程序不存在

问题描述

解决方案

推荐阅读