Azure Policy 模式：逻辑运算符

项目
08/16/2024

策略定义可以包含多个条件语句。可能需要每个语句都为 true，或者只需其中一些语句为 true。为了满足这些需求，语言提供与 not、allOf 和 anyOf 相对应的逻辑运算符。它们是可选的，可以通过嵌套来创建复杂的方案。

示例 1：一个逻辑运算符

此策略定义会评估 Azure Cosmos DB 帐户，以了解是否配置了自动故障转移和多个写入位置。如果尚未配置上述项目，则当创建或更新不合规的资源时，审核会触发并创建一个日志条目。

{
  "properties": {
    "mode": "all",
    "displayName": "Audit Automatic Failover for CosmosDB accounts",
    "description": "This policy audits Automatic Failover for CosmosDB accounts",
    "policyRule": {
      "if": {
        "allOf": [{
            "field": "type",
            "equals": "Microsoft.DocumentDB/databaseAccounts"
          },
          {
            "field": "Microsoft.DocumentDB/databaseAccounts/enableAutomaticFailover",
            "equals": "false"
          },
          {
            "field": "Microsoft.DocumentDB/databaseAccounts/enableMultipleWriteLocations",
            "equals": "false"
          }
        ]
      },
      "then": {
        "effect": "audit"
      }
    },
    "parameters": {},
    "metadata": {}
  }
}

示例 1：说明

"policyRule": {
  "if": {
    "allOf": [{
        "field": "type",
        "equals": "Microsoft.DocumentDB/databaseAccounts"
      },
      {
        "field": "Microsoft.DocumentDB/databaseAccounts/enableAutomaticFailover",
        "equals": "false"
      },
      {
        "field": "Microsoft.DocumentDB/databaseAccounts/enableMultipleWriteLocations",
        "equals": "false"
      }
    ]
  },
  "then": {

policyRule.if 块使用单个 allOf 来确保所有三个条件都为 true。仅当所有这些条件的评估结果都为 true 时，才会执行审核效果触发器。

示例 2：多个逻辑运算符

此策略定义用于评估命名模式的资源。如果资源不匹配，系统会拒绝它。

{
    "properties": {
        "displayName": "Match multiple name patterns.",
        "description": "Allows one of multiple naming patterns for resources.",
        "mode": "Indexed",
        "policyRule": {
            "if": {
                "allOf": [{
                        "not": {
                            "field": "name",
                            "match": "contoso??????"
                        }
                    },
                    {
                        "not": {
                            "field": "name",
                            "match": "contoso-???-##"
                        }
                    }
                ]
            },
            "then": {
                "effect": "deny"
            }
        }
    }
}

示例 2：说明

"if": {
    "allOf": [{
            "not": {
                "field": "name",
                "match": "contoso??????"
            }
        },
        {
            "not": {
                "field": "name",
                "match": "contoso-???-##"
            }
        }
    ]
},

此 policyRule.if 块也包含单个 allOf，但每个条件都使用 not 逻辑运算符进行包装。系统会先评估 not 逻辑运算符中的条件，然后评估该 not，以便确定整个子句是 true 还是 false。如果 not 逻辑运算符的评估结果为 true，则会触发策略效果。

示例 3：组合逻辑运算符

此策略定义会评估 Azure 上的 Spring 帐户，以了解是否未启用跟踪或跟踪未处于成功状态。

{
    "properties": {
        "displayName": "Audit Azure Spring Cloud instances where distributed tracing is not enabled",
        "description": "Distributed tracing tools in Azure Spring Cloud allow debugging and monitoring the complex interconnections between microservices in an application. Distributed tracing tools should be enabled and in a healthy state.",
        "mode": "Indexed",
        "policyRule": {
            "if": {
                "allOf": [{
                        "field": "type",
                        "equals": "Microsoft.AppPlatform/Spring"
                    },
                    {
                        "anyOf": [{
                                "field": "Microsoft.AppPlatform/Spring/trace.enabled",
                                "notEquals": "true"
                            },
                            {
                                "field": "Microsoft.AppPlatform/Spring/trace.state",
                                "notEquals": "Succeeded"
                            }
                        ]
                    }
                ]
            },
            "then": {
                "effect": "audit"
            }
        }
    }
}

示例 3：说明

"policyRule": {
    "if": {
        "allOf": [{
                "field": "type",
                "equals": "Microsoft.AppPlatform/Spring"
            },
            {
                "anyOf": [{
                        "field": "Microsoft.AppPlatform/Spring/trace.enabled",
                        "notEquals": "true"
                    },
                    {
                        "field": "Microsoft.AppPlatform/Spring/trace.state",
                        "notEquals": "Succeeded"
                    }
                ]
            }
        ]
    },
    "then": {
        "effect": "audit"
    }
}

此 policyRule.if 块同时包含 allOf 和 anyOf 逻辑运算符。只要一个包含的条件为 true，anyOf 逻辑运算符就会计算为 true。由于 type 位于 allOf 的核心，因此它必须始终计算为 true。如果 type 和 anyOf 中的条件之一均为 true，则会触发策略效果。

通过