Azure 原則模式：邏輯運算子

發行項
05/02/2024

原則定義可以包含數個條件陳述式。您可能需要每個陳述式都成立，或只需要其中一些條件成立。為了支援這些需求，語言會有 not、allOf 及 anyOf 的邏輯運算子。這些項目都是選擇性的，而且可以透過巢狀方式建立複雜的案例。

範例 1：一個邏輯運算子

此原則定義會評估 Azure CosmosDB 帳戶，以查看是否已設定自動容錯移轉和多個寫入位置。如果未設定，audit 會在建立或更新不符合規範的資源時觸發，並建立記錄項目。

{
  "properties": {
    "mode": "all",
    "displayName": "Audit Automatic Failover for CosmosDB accounts",
    "description": "This policy audits Automatic Failover for CosmosDB accounts",
    "policyRule": {
      "if": {
        "allOf": [{
            "field": "type",
            "equals": "Microsoft.DocumentDB/databaseAccounts"
          },
          {
            "field": "Microsoft.DocumentDB/databaseAccounts/enableAutomaticFailover",
            "equals": "false"
          },
          {
            "field": "Microsoft.DocumentDB/databaseAccounts/enableMultipleWriteLocations",
            "equals": "false"
          }
        ]
      },
      "then": {
        "effect": "audit"
      }
    },
    "parameters": {},
    "metadata": {}
  }
}

範例 1：說明

"policyRule": {
  "if": {
    "allOf": [{
        "field": "type",
        "equals": "Microsoft.DocumentDB/databaseAccounts"
      },
      {
        "field": "Microsoft.DocumentDB/databaseAccounts/enableAutomaticFailover",
        "equals": "false"
      },
      {
        "field": "Microsoft.DocumentDB/databaseAccounts/enableMultipleWriteLocations",
        "equals": "false"
      }
    ]
  },
  "then": {

policyRule.if 區塊會使用單一 allOf 來確保所有三個條件都成立。只有當所有這些條件都評估為 true 時，audit 效果才會觸發。

範例 2：多個邏輯運算子

此原則定義會評估用於命名模式的資源。如果資源不相符，就會遭到拒絕。

{
    "properties": {
        "displayName": "Match multiple name patterns.",
        "description": "Allows one of multiple naming patterns for resources.",
        "mode": "Indexed",
        "policyRule": {
            "if": {
                "allOf": [{
                        "not": {
                            "field": "name",
                            "match": "contoso??????"
                        }
                    },
                    {
                        "not": {
                            "field": "name",
                            "match": "contoso-???-##"
                        }
                    }
                ]
            },
            "then": {
                "effect": "deny"
            }
        }
    }
}

範例 2：說明

"if": {
    "allOf": [{
            "not": {
                "field": "name",
                "match": "contoso??????"
            }
        },
        {
            "not": {
                "field": "name",
                "match": "contoso-???-##"
            }
        }
    ]
},

此 policyRule.if 區塊也包含單一 allOf，但每個條件都會以 not 邏輯運算子來包裝。 not 邏輯運算子內的條件會先進行評估，然後再評估 not 來判斷整個子句為 true 或 false。如果 not 邏輯運算子評估為 true，則會觸發原則效果。

範例 3：結合邏輯運算子

此原則定義會評估 Spring on Azure 帳戶，以查看是否未啟用任何追蹤，或追蹤是否未處於成功狀態。

{
    "properties": {
        "displayName": "Audit Azure Spring Cloud instances where distributed tracing is not enabled",
        "description": "Distributed tracing tools in Azure Spring Cloud allow debugging and monitoring the complex interconnections between microservices in an application. Distributed tracing tools should be enabled and in a healthy state.",
        "mode": "Indexed",
        "policyRule": {
            "if": {
                "allOf": [{
                        "field": "type",
                        "equals": "Microsoft.AppPlatform/Spring"
                    },
                    {
                        "anyOf": [{
                                "field": "Microsoft.AppPlatform/Spring/trace.enabled",
                                "notEquals": "true"
                            },
                            {
                                "field": "Microsoft.AppPlatform/Spring/trace.state",
                                "notEquals": "Succeeded"
                            }
                        ]
                    }
                ]
            },
            "then": {
                "effect": "audit"
            }
        }
    }
}

範例 3：說明

"policyRule": {
    "if": {
        "allOf": [{
                "field": "type",
                "equals": "Microsoft.AppPlatform/Spring"
            },
            {
                "anyOf": [{
                        "field": "Microsoft.AppPlatform/Spring/trace.enabled",
                        "notEquals": "true"
                    },
                    {
                        "field": "Microsoft.AppPlatform/Spring/trace.state",
                        "notEquals": "Succeeded"
                    }
                ]
            }
        ]
    },
    "then": {
        "effect": "audit"
    }
}

此 policyRule.if 區塊同時包含 allOf 和 anyOf 邏輯運算子。只要其中一個包含的條件為 True，anyOf 邏輯運算子就會評估為 True。當「類型」是 allOf 的核心時，則一律會評估為 True。如果「類型」和 anyOf 中的其中一個條件為 True，則會觸發原則效果。

Share via