在订阅级别创建资源组和资源Create resource groups and resources at the subscription level

通常情况下,你可将 Azure 资源部署到 Azure 订阅中的资源组。Typically, you deploy Azure resources to a resource group in your Azure subscription. 但是,也可在订阅级别创建资源。However, you can also create resources at the subscription level. 可以使用订阅级别部署来执行在该级别合理的操作,例如创建资源组或分配基于角色的访问控制You use subscription level deployments to take actions that make sense at that level, such as creating resource groups, or assigning role-based access control.

若要在订阅级别部署模板,请使用 Azure CLI、PowerShell 或 REST API。To deploy templates at the subscription level, use Azure CLI, PowerShell, or REST API. Azure 门户不支持在订阅级别部署。The Azure portal doesn't support deployment in the subscription level.

支持的资源Supported resources

架构Schema

用于订阅级别部署的架构不同于资源组部署的架构。The schema you use for subscription-level deployments is different than the schema for resource group deployments.

对于模板,请使用:For templates, use:

https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#

对于参数文件,请使用:For parameter files, use:

https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentParameters.json#

部署命令Deployment commands

用于订阅级别部署的命令不同于资源组部署的命令。The commands for subscription-level deployments are different than the commands for resource group deployments.

对于 Azure CLI,请使用 az deployment createFor the Azure CLI, use az deployment create. 以下示例通过部署模板来创建资源组:The following example deploys a template to create a resource group:

az deployment create \
  --name demoDeployment \
  --location chinaeast \
  --template-uri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/emptyRG.json \
  --parameters rgName=demoResourceGroup rgLocation=chinaeast

对于 PowerShell 部署命令,请使用 New-AzDeploymentFor the PowerShell deployment command, use New-AzDeployment. 以下示例通过部署模板来创建资源组:The following example deploys a template to create a resource group:

New-AzDeployment `
  -Name demoDeployment `
  -Location chinaeast `
  -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/emptyRG.json `
  -rgName demoResourceGroup `
  -rgLocation chinaeast

对于 REST API,请使用部署 - 在订阅范围内创建For REST API, use Deployments - Create At Subscription Scope.

部署位置和名称Deployment location and name

对于订阅级别部署,必须为部署提供位置。For subscription level deployments, you must provide a location for the deployment. 部署位置独立于部署的资源的位置。The location of the deployment is separate from the location of the resources you deploy. 部署位置指定何处存储部署数据。The deployment location specifies where to store deployment data.

可以为部署提供一个名称,也可以使用默认部署名称。You can provide a name for the deployment, or use the default deployment name. 默认名称是模板文件的名称。The default name is the name of the template file. 例如,部署一个名为 azuredeploy.json 的模板将创建默认部署名称 azuredeployFor example, deploying a template named azuredeploy.json creates a default deployment name of azuredeploy.

每个部署名称的位置不可变。For each deployment name, the location is immutable. 当某个位置中已有某个部署时,无法在另一位置创建同名的部署。You can't create a deployment in one location when there's an existing deployment with the same name in a different location. 如果出现错误代码 InvalidDeploymentLocation,请使用其他名称或使用与该名称的以前部署相同的位置。If you get the error code InvalidDeploymentLocation, either use a different name or the same location as the previous deployment for that name.

使用模板函数Use template functions

对于订阅级别部署,在使用模板函数时有一些重要注意事项:For subscription-level deployments, there are some important considerations when using template functions:

  • 不支持 resourceGroup() 函数。 The resourceGroup() function is not supported.
  • 支持 resourceId() 函数。The resourceId() function is supported. 可以使用它获取在订阅级部署中使用的资源的资源 ID。Use it to get the resource ID for resources that are used at subscription level deployments. 例如,使用 resourceId('Microsoft.Authorization/roleDefinitions/', parameters('roleDefinition')) 获取策略定义的资源 ID。For example, get the resource ID for a policy definition with resourceId('Microsoft.Authorization/roleDefinitions/', parameters('roleDefinition')). 也可使用 subscriptionResourceId() 函数获取订阅级别资源的资源 ID。Or, use the subscriptionResourceId() function to get the resource ID for a subscription level resource.
  • 支持 reference()list() 函数。The reference() and list() functions are supported.

创建资源组Create resource groups

若要在 Azure 资源管理器模板中创建资源组,请为该资源组定义包含名称和位置的 Microsoft.Resources/resourceGroups 资源。To create a resource group in an Azure Resource Manager template, define a Microsoft.Resources/resourceGroups resource with a name and location for the resource group. 你可以创建一个资源组并在同一模板中将资源部署到该资源组。You can create a resource group and deploy resources to that resource group in the same template.

以下模板创建空资源组。The following template creates an empty resource group.

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.1",
    "parameters": {
        "rgName": {
            "type": "string"
        },
        "rgLocation": {
            "type": "string"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2018-05-01",
            "location": "[parameters('rgLocation')]",
            "name": "[parameters('rgName')]",
            "properties": {}
        }
    ],
    "outputs": {}
}

结合使用 copy 元素与资源组来创建多个资源组。Use the copy element with resource groups to create more than one resource group.

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.1",
    "parameters": {
        "rgNamePrefix": {
            "type": "string"
        },
        "rgLocation": {
            "type": "string"
        },
        "instanceCount": {
            "type": "int"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2018-05-01",
            "location": "[parameters('rgLocation')]",
            "name": "[concat(parameters('rgNamePrefix'), copyIndex())]",
            "copy": {
                "name": "rgCopy",
                "count": "[parameters('instanceCount')]"
            },
            "properties": {}
        }
    ],
    "outputs": {}
}

有关资源迭代的信息,请参阅在 Azure 资源管理器模板中部署资源或属性的多个实例,以及教程:使用资源管理器模板创建多个资源实例For information about resource iteration, see Deploy more than one instance of a resource or property in Azure Resource Manager Templates, and Tutorial: Create multiple resource instances with Resource Manager templates.

资源组和资源Resource group and resources

若要创建资源组并向其部署资源,请使用嵌套模板。To create the resource group and deploy resources to it, use a nested template. 嵌套模板定义要部署到资源组的资源。The nested template defines the resources to deploy to the resource group. 将嵌套模板设置为依赖于资源组,确保资源组存在,然后再部署资源。Set the nested template as dependent on the resource group to make sure the resource group exists before deploying the resources.

以下示例将创建一个资源组,并向该资源组部署存储帐户。The following example creates a resource group, and deploys a storage account to the resource group.

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.1",
    "parameters": {
        "rgName": {
            "type": "string"
        },
        "rgLocation": {
            "type": "string"
        },
        "storagePrefix": {
            "type": "string",
            "maxLength": 11
        }
    },
    "variables": {
        "storageName": "[concat(parameters('storagePrefix'), uniqueString(subscription().id, parameters('rgName')))]"
    },
    "resources": [
        {
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2018-05-01",
            "location": "[parameters('rgLocation')]",
            "name": "[parameters('rgName')]",
            "properties": {}
        },
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2018-05-01",
            "name": "storageDeployment",
            "resourceGroup": "[parameters('rgName')]",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/resourceGroups/', parameters('rgName'))]"
            ],
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {},
                    "variables": {},
                    "resources": [
                        {
                            "type": "Microsoft.Storage/storageAccounts",
                            "apiVersion": "2017-10-01",
                            "name": "[variables('storageName')]",
                            "location": "[parameters('rgLocation')]",
                            "kind": "StorageV2",
                            "sku": {
                                "name": "Standard_LRS"
                            }
                        }
                    ],
                    "outputs": {}
                }
            }
        }
    ],
    "outputs": {}
}

创建策略Create policies

分配策略Assign policy

以下示例将现有的策略定义分配到订阅。The following example assigns an existing policy definition to the subscription. 如果策略使用参数,请将参数作为对象提供。If the policy takes parameters, provide them as an object. 如果策略不使用参数,请使用默认的空对象。If the policy doesn't take parameters, use the default empty object.

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "policyDefinitionID": {
            "type": "string"
        },
        "policyName": {
            "type": "string"
        },
        "policyParameters": {
            "type": "object",
            "defaultValue": {}
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Authorization/policyAssignments",
            "name": "[parameters('policyName')]",
            "apiVersion": "2018-03-01",
            "properties": {
                "scope": "[subscription().id]",
                "policyDefinitionId": "[parameters('policyDefinitionID')]",
                "parameters": "[parameters('policyParameters')]"
            }
        }
    ]
}

若要使用 Azure CLI 部署此模板,请使用:To deploy this template with Azure CLI, use:

# Built-in policy that accepts parameters
definition=$(az policy definition list --query "[?displayName=='Allowed locations'].id" --output tsv)

az deployment create \
  --name demoDeployment \
  --location chinaeast \
  --template-uri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/policyassign.json \
  --parameters policyDefinitionID=$definition policyName=setLocation policyParameters="{'listOfAllowedLocations': {'value': ['chinanorth']} }"

若要使用 PowerShell 部署此模板,请使用:To deploy this template with PowerShell, use:

$definition = Get-AzPolicyDefinition | Where-Object { $_.Properties.DisplayName -eq 'Allowed locations' }

$locations = @("chinanorth", "chinanorth2")
$policyParams =@{listOfAllowedLocations = @{ value = $locations}}

New-AzDeployment `
  -Name policyassign `
  -Location chinaeast `
  -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/policyassign.json `
  -policyDefinitionID $definition.PolicyDefinitionId `
  -policyName setLocation `
  -policyParameters $policyParams

定义和分配策略Define and assign policy

可以在同一模板中定义和分配策略。You can define and assign a policy in the same template.

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Authorization/policyDefinitions",
            "name": "locationpolicy",
            "apiVersion": "2018-05-01",
            "properties": {
                "policyType": "Custom",
                "parameters": {},
                "policyRule": {
                    "if": {
                        "field": "location",
                        "equals": "northeurope"
                    },
                    "then": {
                        "effect": "deny"
                    }
                }
            }
        },
        {
            "type": "Microsoft.Authorization/policyAssignments",
            "name": "location-lock",
            "apiVersion": "2018-05-01",
            "dependsOn": [
                "locationpolicy"
            ],
            "properties": {
                "scope": "[subscription().id]",
                "policyDefinitionId": "[resourceId('Microsoft.Authorization/policyDefinitions', 'locationpolicy')]"
            }
        }
    ]
}

若要在订阅中创建策略定义,然后将其应用到订阅,请使用以下 CLI 命令:To create the policy definition in your subscription, and apply it to the subscription, use the following CLI command:

az deployment create \
  --name demoDeployment \
  --location chinaeast \
  --template-uri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/policydefineandassign.json

若要使用 PowerShell 部署此模板,请使用:To deploy this template with PowerShell, use:

New-AzDeployment `
  -Name definePolicy `
  -Location chinaeast `
  -TemplateUri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/policydefineandassign.json

后续步骤Next steps