你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

New-AzPolicyAttestation

参考

模块:: Az.PolicyInsights

为策略分配创建新的策略证明。

语法

New-AzPolicyAttestation
   -Name <String>
   [-Scope <String>]
   [-ResourceGroupName <String>]
   -PolicyAssignmentId <String>
   [-ComplianceState <String>]
   [-PolicyDefinitionReferenceId <String>]
   [-ExpiresOn <DateTime>]
   [-Owner <String>]
   [-Comment <String>]
   [-Evidence <PSAttestationEvidence[]>]
   [-AssessmentDate <DateTime>]
   [-Metadata <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

New-AzPolicyAttestation
   -ResourceId <String>
   -PolicyAssignmentId <String>
   [-ComplianceState <String>]
   [-PolicyDefinitionReferenceId <String>]
   [-ExpiresOn <DateTime>]
   [-Owner <String>]
   [-Comment <String>]
   [-Evidence <PSAttestationEvidence[]>]
   [-AssessmentDate <DateTime>]
   [-Metadata <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

说明

New-AzPolicyAttestation cmdlet 为特定策略分配创建策略证明。 Azure Policy 使用证明来设置手动策略所针对的资源或范围的符合性状态。它们还允许用户提供附加的元数据或已证明的符合性状态随附的证据链接。

示例

示例 1：在订阅范围内创建证明

Set-AzContext -Subscription "d1acb22b-c876-44f7-b08e-3fcf9f6767f4"
$policyAssignmentId = "/subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/policyassignments/psattestationsubassignment"
$attestationName = "attestation-subscription"
New-AzPolicyAttestation -PolicyAssignmentId $policyAssignmentId -Name $attestationName -ComplianceState "Compliant"

Id                          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.policyinsights
                              /attestations/attestation-subscription
Name                        : attestation-subscription
Type                        : Microsoft.PolicyInsights/attestations
PolicyAssignmentId          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/
                              policyassignments/psattestationsubassignment
PolicyDefinitionReferenceId :
ComplianceState             : Compliant
ExpiresOn                   :
Owner                       :
Comment                     :
Evidence                    :
ProvisioningState           : Succeeded
LastComplianceStateChangeAt : 1/27/2023 2:26:24 AM
AssessmentDate              :
Metadata                    :
SystemData                  :

此命令在给定策略分配的订阅“d1acb22b-c876-44f7-b08e-3fcf9f6767f4”上创建新的策略证明。

注意： 此命令为订阅创建证明，而不是其下的资源。为了便于管理，应将手动策略设计为针对定义需证明其符合性状态的资源边界的范围。在这种情况下，手动策略应面向 Microsoft.Resources/subscriptions。有关详细信息，请转到 https://learn.microsoft.com/en-us/azure/governance/policy/concepts/attestation-structure 了解创建证明的最佳做法。

示例 2：在资源组中创建证明

$policyAssignmentId = "/subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/policyassignments/psattestationrgassignment"
$attestationName = "attestation-RG"
$rgName = "ps-attestation-test-rg"
New-AzPolicyAttestation -ResourceGroupName $RGName -PolicyAssignmentId $policyAssignmentId -Name $attestationName -ComplianceState "Compliant"

Id                          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/resourcegroups/ps-attestation-test
                              -rg/providers/microsoft.policyinsights/attestations/attestation-rg
Name                        : attestation-RG
Type                        : Microsoft.PolicyInsights/attestations
PolicyAssignmentId          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/
                              policyassignments/psattestationrgassignment
PolicyDefinitionReferenceId :
ComplianceState             : Compliant
ExpiresOn                   :
Owner                       :
Comment                     :
Evidence                    :
ProvisioningState           : Succeeded
LastComplianceStateChangeAt : 1/27/2023 2:35:28 AM
AssessmentDate              :
Metadata                    :
SystemData                  :

此命令在给定策略分配的资源组“ps-attestation-test-rg”处创建新的策略证明。

注意： 此命令为资源组创建证明，而不是其下的资源。为了便于管理，应将手动策略设计为针对定义需证明其符合性状态的资源边界的范围。在这种情况下，手动策略应面向 Microsoft.Resources/subscriptions/resourceGroups。有关详细信息，请转到 https://learn.microsoft.com/en-us/azure/governance/policy/concepts/attestation-structure 了解创建证明的最佳做法。

示例 3：在资源中创建证明

$policyAssignmentId = "/subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/policyassignments/psattestationresourceassignment"
$attestationName = "attestation-resource"
$scope = "/subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/resourceGroups/ps-attestation-test-rg/providers/Microsoft.Network/networkSecurityGroups/pstests0"
New-AzPolicyAttestation `
    -PolicyAssignmentId $policyAssignmentId `
    -Name $attestationName `
    -Scope $scope `
    -ComplianceState "NonCompliant"

Id                          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/resourcegroups/ps-attestation-test
                              -rg/providers/microsoft.network/networksecuritygroups/pstests0/providers/microsoft.pol
                              icyinsights/attestations/attestation-resource
Name                        : attestation-resource
Type                        : Microsoft.PolicyInsights/attestations
PolicyAssignmentId          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/
                              policyassignments/psattestationresourceassignment
PolicyDefinitionReferenceId :
ComplianceState             : NonCompliant
ExpiresOn                   :
Owner                       :
Comment                     :
Evidence                    :
ProvisioningState           : Succeeded
LastComplianceStateChangeAt : 1/27/2023 2:38:17 AM
AssessmentDate              :
Metadata                    :
SystemData                  :

此命令为给定策略分配的资源“pstests0”创建证明。

示例 4：使用资源组中的所有属性创建证明

$attestationName = "attestationRGAllProps"
$policyInitiativeAssignmentId = "/subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/policyassignments/psattestationinitiativergassignment"

$policyDefinitionReferenceId = "PSTestAttestationRG_1"
$RGName = "ps-attestation-test-rg"
$description = "This is a test description"
$sourceURI = "https://contoso.org/test.pdf"
$evidence = @{
    "Description"=$description
    "SourceUri"=$sourceURI
}
$policyEvidence = @($evidence)
$owner = "Test Owner"
$expiresOn = [datetime]::UtcNow.AddYears(1)
$metadata = '{"TestKey":"TestValue"}'

New-AzPolicyAttestation `
    -Name $attestationName `
    -ResourceGroupName $RGName `
    -PolicyAssignmentId $policyInitiativeAssignmentId `
    -PolicyDefinitionReferenceId $policyDefinitionReferenceId `
    -ComplianceState $Compliant `
    -Comment $comment `
    -Evidence $policyEvidence `
    -ExpiresOn $expiresOn `
    -AssessmentDate $expiresOn.AddDays(-2) `
    -Owner $owner `
    -Metadata $metadata

Id                          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/resourcegroups/ps-attestation-test
                              -rg/providers/microsoft.policyinsights/attestations/attestationrgallprops
Name                        : attestationRGAllProps
Type                        : Microsoft.PolicyInsights/attestations
PolicyAssignmentId          : /subscriptions/d1acb22b-c876-44f7-b08e-3fcf9f6767f4/providers/microsoft.authorization/
                              policyassignments/psattestationinitiativergassignment
PolicyDefinitionReferenceId : pstestattestationrg_1
ComplianceState             :
ExpiresOn                   : 1/27/2024 2:51:54 AM
Owner                       : Test Owner
Comment                     :
Evidence                    : {Microsoft.Azure.Commands.PolicyInsights.Models.Attestations.PSAttestationEvidence}
ProvisioningState           : Succeeded
LastComplianceStateChangeAt : 1/27/2023 2:51:57 AM
AssessmentDate              : 1/25/2024 2:51:54 AM
Metadata                    : {
                                "TestKey": "TestValue"
                              }
SystemData                  :

参数

-AssessmentDate

评估证明证据的时间。

Type:	Nullable<T>[DateTime]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Comment

描述创建此证明的原因的注释。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-ComplianceState

资源的符合性状态。例如“合规”、“不合规”、“未知”

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Confirm

提示你在运行 cmdlet 之前进行确认。

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

用于与 Azure 通信的凭据、帐户、租户和订阅。

Type:	IAzureContextContainer
Aliases:	AzContext, AzureRmContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Evidence

支持此证明中设置符合性状态的证据。

Type:	PSAttestationEvidence[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-ExpiresOn

证明中设置的符合性状态应过期的时间。

Type:	Nullable<T>[DateTime]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Metadata

证明的其他元数据。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Name

资源名称。

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-Owner

负责设置资源状态的人员。此值通常是 Microsoft Entra 对象 ID。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-PolicyAssignmentId

策略分配 ID。例如“/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/{assignmentName}”。

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-PolicyDefinitionReferenceId

单个定义的策略定义引用 ID。当策略分配分配分配策略集定义时是必需的。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-ResourceGroupName

资源组名称。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-ResourceId

资源 ID。

Type:	String
Aliases:	Id
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-Scope

资源的范围。例如“/subscriptions/{subscriptionId}/resourceGroups/{rgName}”。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-WhatIf

显示运行该 cmdlet 时会发生什么情况。 cmdlet 未运行。

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

输入

String

Nullable<T>[[System.DateTime, System.Private.CoreLib, Version=7.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]

PSAttestationEvidence[]

Object

输出

PSAttestation

New-AzPolicyAttestation

语法

说明

示例

示例 1：在订阅范围内创建证明

示例 2：在资源组中创建证明

示例 3：在资源中创建证明

示例 4：使用资源组中的所有属性创建证明

参数

-AssessmentDate

-Comment

-ComplianceState

-Confirm

-DefaultProfile

-Evidence

-ExpiresOn

-Metadata

-Name

-Owner

-PolicyAssignmentId

-PolicyDefinitionReferenceId

-ResourceGroupName

-ResourceId

-Scope

-WhatIf

输入

输出

反馈

其他资源

New-AzPolicyAttestation

语法

说明

示例

示例 1：在订阅范围内创建证明

示例 2：在资源组中创建证明

示例 3：在资源中创建证明

示例 4：使用资源组中的所有属性创建证明

参数

-AssessmentDate

-Comment

-ComplianceState

-Confirm

-DefaultProfile

-Evidence

-ExpiresOn

-Metadata

-Name

-Owner

-PolicyAssignmentId

-PolicyDefinitionReferenceId

-ResourceGroupName

-ResourceId

-Scope

-WhatIf

输入

输出

相关链接

反馈

其他资源