azure - Azure Policy Tag with predefined values

Question

I struggling currently at some point with Azure Policy. I want to enforce a specific Tag and its value. (Sounds standard) But I want to allow one value from a predefined set which during creation is needed. For e.g.

Environment: (Any of these predefined values are allowed)

• Dev
• Test
• Prod
• PreProd

I created an Initiative with some other policies and when I assign this Initiative.

It will enforce only the chosen value but all other values are not allowed.

  "properties": {
    "displayName": "Tag3",
    "policyType": "Custom",
    "mode": "All",
    "metadata": {
    },
    "parameters": {
      "tags": {
        "type": "Array",
        "metadata": {
          "displayName": "Environment",
          "description": "The list of Environments"
        },
        "allowedValues": [
          "Test",
          "Dev",
          "PreProd",
          "Prod"
        ],
        "defaultValue": [
          "Prod"
        ]
      }
    },
    "policyRule": {
      "if": {
        "not": {
          "field": "tags",
          "in": "[parameters('tags')]"
        }
      },
      "then": {
        "effect": "deny"
      }
    }
  }

Answer 1

你可以试试这个吗？...

"properties": {
    "displayName": "Tag3",
    "policyType": "Custom",
    "mode": "All",
    "metadata": {
    },
    "parameters": {
      "tags": {
        "type": "Array",
        "metadata": {
          "displayName": "Environment",
          "description": "The list of Environments"
        },
        "allowedValues": [
          "Test",
          "Dev",
          "PreProd",
          "Prod"
        ],
        "defaultValue": [
          "Prod"
        ]
      }
    },
    "policyRule": {
      "if": {
        "not": {"or": {
          {"field": "tags",
          "equals": "Test"},
          {"field": "tags",
          "equals": "Dev"},
          {"field": "tags",
          "equals": "PreProd"},
          {"field": "tags",
          "equals": "Prod"},
        }
       }
      },
      "then": {
        "effect": "deny"
      }
    }
  }

Answer 2

设置defaultValue不带[]. 像这个："defaultValue": "Prod"。

更多细节，你可以参考这篇文章。

Answer 3

选项 1：删除“defaultvalue”属性，并在分配策略时提供所需值的列表，作为“;” 分隔列表：

Test;Dev;PreProd

选项2：将“默认值”保留为数组，填充所有允许的值：

"defaultvalue": [
          "Test",
          "Dev",
          "PreProd",
          "Prod"
        ]