Policy Definitions - Create Or Update

Служба:: Policy

Версия API:: 2023-04-01

Создает или обновляет определение политики в подписке.
Эта операция создает или обновляет определение политики в данной подписке с заданным именем.

PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}?api-version=2023-04-01

Параметры URI

Имя	В	Обязательно	Тип	Описание
policyDefinitionName	path	True	string pattern: ^[^<>%&:\?.+/][^<>*%&:\?.+/ ]+$	Имя создаваемого определения политики.
subscriptionId	path	True	string (uuid)	Идентификатор целевой подписки. Значение должно быть UUID.
api-version	query	True	string minLength: 1	Версия API, используемая для этой операции.

Текст запроса

Имя	Тип	Описание
properties.description	string	Описание определения политики.
properties.displayName	string	Отображаемое имя определения политики.
properties.metadata	object	Метаданные определения политики. Метаданные — это открытый завершенный объект, который обычно представляет собой коллекцию пар значений ключей.
properties.mode	string	Режим определения политики. Ниже приведены примеры All, Indexed, Microsoft.KeyVault.Data.
properties.parameters	<string, ParameterDefinitionsValue>	Определения параметров для параметров, используемых в правиле политики. Ключи — это имена параметров.
properties.policyRule	object	Правило политики.
properties.policyType	policyType	Тип определения политики. Возможные значения: NotSpecified, BuiltIn, Custom и Static.
properties.version	string	Версия определения политики в формате #.#.#
properties.versions	string[]	Список доступных версий для этого определения политики.

Ответы

Имя	Тип	Описание
201 Created	PolicyDefinition	Создано — возвращает сведения о определении политики.
Other Status Codes	CloudError	Ответ на ошибку, описывающий причину сбоя операции.

Безопасность

azure_auth

Поток OAuth2 Azure Active Directory.

Тип: oauth2
Flow: implicit
URL-адрес авторизации: https://login.microsoftonline.com/common/oauth2/authorize

Области

Имя	Описание
user_impersonation	олицетворения учетной записи пользователя

Примеры

Create or update a policy definition

Create or update a policy definition with advanced parameters

Create or update a policy definition

Образец запроса

PUT https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming?api-version=2023-04-01

{
  "properties": {
    "mode": "All",
    "displayName": "Enforce resource naming convention",
    "description": "Force resource names to begin with given 'prefix' and/or end with given 'suffix'",
    "metadata": {
      "category": "Naming"
    },
    "policyRule": {
      "if": {
        "not": {
          "field": "name",
          "like": "[concat(parameters('prefix'), '*', parameters('suffix'))]"
        }
      },
      "then": {
        "effect": "deny"
      }
    },
    "parameters": {
      "prefix": {
        "type": "String",
        "metadata": {
          "displayName": "Prefix",
          "description": "Resource name prefix"
        }
      },
      "suffix": {
        "type": "String",
        "metadata": {
          "displayName": "Suffix",
          "description": "Resource name suffix"
        }
      }
    }
  }
}


import com.azure.core.management.serializer.SerializerFactory;
import com.azure.core.util.serializer.SerializerEncoding;
import com.azure.resourcemanager.resources.fluent.models.PolicyDefinitionInner;
import com.azure.resourcemanager.resources.models.ParameterDefinitionsValue;
import com.azure.resourcemanager.resources.models.ParameterDefinitionsValueMetadata;
import com.azure.resourcemanager.resources.models.ParameterType;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * Samples for PolicyDefinitions CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/
     * createOrUpdatePolicyDefinition.json
     */
    /**
     * Sample code: Create or update a policy definition.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void createOrUpdateAPolicyDefinition(com.azure.resourcemanager.AzureResourceManager azure)
        throws IOException {
        azure.genericResources().manager().policyClient().getPolicyDefinitions().createOrUpdateWithResponse(
            "ResourceNaming",
            new PolicyDefinitionInner().withMode("All").withDisplayName("Enforce resource naming convention")
                .withDescription("Force resource names to begin with given 'prefix' and/or end with given 'suffix'")
                .withPolicyRule(SerializerFactory.createDefaultManagementSerializerAdapter().deserialize(
                    "{\"if\":{\"not\":{\"field\":\"name\",\"like\":\"[concat(parameters('prefix'), '*', parameters('suffix'))]\"}},\"then\":{\"effect\":\"deny\"}}",
                    Object.class, SerializerEncoding.JSON))
                .withMetadata(SerializerFactory.createDefaultManagementSerializerAdapter()
                    .deserialize("{\"category\":\"Naming\"}", Object.class, SerializerEncoding.JSON))
                .withParameters(mapOf("prefix",
                    new ParameterDefinitionsValue().withType(ParameterType.STRING)
                        .withMetadata(new ParameterDefinitionsValueMetadata().withDisplayName("Prefix")
                            .withDescription("Resource name prefix").withAdditionalProperties(mapOf())),
                    "suffix",
                    new ParameterDefinitionsValue().withType(ParameterType.STRING)
                        .withMetadata(new ParameterDefinitionsValueMetadata().withDisplayName("Suffix")
                            .withDescription("Resource name suffix").withAdditionalProperties(mapOf())))),
            com.azure.core.util.Context.NONE);
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.resource.policy import PolicyClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-resource
# USAGE
    python create_or_update_policy_definition.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = PolicyClient(
        credential=DefaultAzureCredential(),
        subscription_id="ae640e6b-ba3e-4256-9d62-2993eecfa6f2",
    )

    response = client.policy_definitions.create_or_update(
        policy_definition_name="ResourceNaming",
        parameters={
            "properties": {
                "description": "Force resource names to begin with given 'prefix' and/or end with given 'suffix'",
                "displayName": "Enforce resource naming convention",
                "metadata": {"category": "Naming"},
                "mode": "All",
                "parameters": {
                    "prefix": {
                        "metadata": {"description": "Resource name prefix", "displayName": "Prefix"},
                        "type": "String",
                    },
                    "suffix": {
                        "metadata": {"description": "Resource name suffix", "displayName": "Suffix"},
                        "type": "String",
                    },
                },
                "policyRule": {
                    "if": {
                        "not": {"field": "name", "like": "[concat(parameters('prefix'), '*', parameters('suffix'))]"}
                    },
                    "then": {"effect": "deny"},
                },
            }
        },
    )
    print(response)


# x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/createOrUpdatePolicyDefinition.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armpolicy_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armpolicy"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/219b2e3ef270f18149774eb2793b48baacde982f/specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/createOrUpdatePolicyDefinition.json
func ExampleDefinitionsClient_CreateOrUpdate_createOrUpdateAPolicyDefinition() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armpolicy.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	_, err = clientFactory.NewDefinitionsClient().CreateOrUpdate(ctx, "ResourceNaming", armpolicy.Definition{
		Properties: &armpolicy.DefinitionProperties{
			Description: to.Ptr("Force resource names to begin with given 'prefix' and/or end with given 'suffix'"),
			DisplayName: to.Ptr("Enforce resource naming convention"),
			Metadata: map[string]any{
				"category": "Naming",
			},
			Mode: to.Ptr("All"),
			Parameters: map[string]*armpolicy.ParameterDefinitionsValue{
				"prefix": {
					Type: to.Ptr(armpolicy.ParameterTypeString),
					Metadata: &armpolicy.ParameterDefinitionsValueMetadata{
						Description: to.Ptr("Resource name prefix"),
						DisplayName: to.Ptr("Prefix"),
					},
				},
				"suffix": {
					Type: to.Ptr(armpolicy.ParameterTypeString),
					Metadata: &armpolicy.ParameterDefinitionsValueMetadata{
						Description: to.Ptr("Resource name suffix"),
						DisplayName: to.Ptr("Suffix"),
					},
				},
			},
			PolicyRule: map[string]any{
				"if": map[string]any{
					"not": map[string]any{
						"field": "name",
						"like":  "[concat(parameters('prefix'), '*', parameters('suffix'))]",
					},
				},
				"then": map[string]any{
					"effect": "deny",
				},
			},
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { PolicyClient } = require("@azure/arm-policy");
const { DefaultAzureCredential } = require("@azure/identity");
require("dotenv/config");

/**
 * This sample demonstrates how to This operation creates or updates a policy definition in the given subscription with the given name.
 *
 * @summary This operation creates or updates a policy definition in the given subscription with the given name.
 * x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/createOrUpdatePolicyDefinition.json
 */
async function createOrUpdateAPolicyDefinition() {
  const subscriptionId =
    process.env["POLICY_SUBSCRIPTION_ID"] || "ae640e6b-ba3e-4256-9d62-2993eecfa6f2";
  const policyDefinitionName = "ResourceNaming";
  const parameters = {
    description: "Force resource names to begin with given 'prefix' and/or end with given 'suffix'",
    displayName: "Enforce resource naming convention",
    metadata: { category: "Naming" },
    mode: "All",
    parameters: {
      prefix: {
        type: "String",
        metadata: {
          description: "Resource name prefix",
          displayName: "Prefix",
        },
      },
      suffix: {
        type: "String",
        metadata: {
          description: "Resource name suffix",
          displayName: "Suffix",
        },
      },
    },
    policyRule: {
      if: {
        not: {
          field: "name",
          like: "[concat(parameters('prefix'), '*', parameters('suffix'))]",
        },
      },
      then: { effect: "deny" },
    },
  };
  const credential = new DefaultAzureCredential();
  const client = new PolicyClient(credential, subscriptionId);
  const result = await client.policyDefinitions.createOrUpdate(policyDefinitionName, parameters);
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Пример ответа

Код состояния:: 201

{
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "ResourceNaming",
  "properties": {
    "mode": "All",
    "displayName": "Naming Convention",
    "description": "Force resource names to begin with 'prefix' and end with 'suffix'",
    "metadata": {
      "category": "Naming"
    },
    "version": "1.2.1",
    "versions": [
      "1.2.1",
      "1.0.0"
    ],
    "policyRule": {
      "if": {
        "not": {
          "field": "name",
          "like": "[concat(parameters('prefix'), '*', parameters('suffix'))]"
        }
      },
      "then": {
        "effect": "deny"
      }
    },
    "parameters": {
      "prefix": {
        "type": "String",
        "metadata": {
          "displayName": "Prefix",
          "description": "Resource name prefix"
        }
      },
      "suffix": {
        "type": "String",
        "metadata": {
          "displayName": "Suffix",
          "description": "Resource name suffix"
        }
      }
    },
    "policyType": "Custom"
  }
}

Create or update a policy definition with advanced parameters

Образец запроса

PUT https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyDefinitions/EventHubDiagnosticLogs?api-version=2023-04-01

{
  "properties": {
    "mode": "Indexed",
    "displayName": "Event Hubs should have diagnostic logging enabled",
    "description": "Audit enabling of logs and retain them up to a year. This enables recreation of activity trails for investigation purposes when a security incident occurs or your network is compromised",
    "metadata": {
      "category": "Event Hub"
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.EventHub/namespaces"
      },
      "then": {
        "effect": "AuditIfNotExists",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
                "equals": "true"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days",
                "equals": "[parameters('requiredRetentionDays')]"
              }
            ]
          }
        }
      }
    },
    "parameters": {
      "requiredRetentionDays": {
        "type": "Integer",
        "defaultValue": 365,
        "allowedValues": [
          0,
          30,
          90,
          180,
          365
        ],
        "metadata": {
          "displayName": "Required retention (days)",
          "description": "The required diagnostic logs retention in days"
        }
      }
    }
  }
}


import com.azure.core.management.serializer.SerializerFactory;
import com.azure.core.util.serializer.SerializerEncoding;
import com.azure.resourcemanager.resources.fluent.models.PolicyDefinitionInner;
import com.azure.resourcemanager.resources.models.ParameterDefinitionsValue;
import com.azure.resourcemanager.resources.models.ParameterDefinitionsValueMetadata;
import com.azure.resourcemanager.resources.models.ParameterType;
import java.io.IOException;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;

/**
 * Samples for PolicyDefinitions CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/
     * createOrUpdatePolicyDefinitionAdvancedParams.json
     */
    /**
     * Sample code: Create or update a policy definition with advanced parameters.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void createOrUpdateAPolicyDefinitionWithAdvancedParameters(
        com.azure.resourcemanager.AzureResourceManager azure) throws IOException {
        azure.genericResources().manager().policyClient().getPolicyDefinitions()
            .createOrUpdateWithResponse("EventHubDiagnosticLogs", new PolicyDefinitionInner().withMode("Indexed")
                .withDisplayName("Event Hubs should have diagnostic logging enabled")
                .withDescription(
                    "Audit enabling of logs and retain them up to a year. This enables recreation of activity trails for investigation purposes when a security incident occurs or your network is compromised")
                .withPolicyRule(SerializerFactory.createDefaultManagementSerializerAdapter().deserialize(
                    "{\"if\":{\"equals\":\"Microsoft.EventHub/namespaces\",\"field\":\"type\"},\"then\":{\"effect\":\"AuditIfNotExists\",\"details\":{\"type\":\"Microsoft.Insights/diagnosticSettings\",\"existenceCondition\":{\"allOf\":[{\"equals\":\"true\",\"field\":\"Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled\"},{\"equals\":\"[parameters('requiredRetentionDays')]\",\"field\":\"Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days\"}]}}}}",
                    Object.class, SerializerEncoding.JSON))
                .withMetadata(SerializerFactory.createDefaultManagementSerializerAdapter()
                    .deserialize("{\"category\":\"Event Hub\"}", Object.class, SerializerEncoding.JSON))
                .withParameters(mapOf("requiredRetentionDays", new ParameterDefinitionsValue()
                    .withType(ParameterType.INTEGER).withAllowedValues(Arrays.asList(0, 30, 90, 180, 365))
                    .withDefaultValue(365)
                    .withMetadata(new ParameterDefinitionsValueMetadata().withDisplayName("Required retention (days)")
                        .withDescription("The required diagnostic logs retention in days")
                        .withAdditionalProperties(mapOf())))),
                com.azure.core.util.Context.NONE);
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.resource.policy import PolicyClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-resource
# USAGE
    python create_or_update_policy_definition_advanced_params.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = PolicyClient(
        credential=DefaultAzureCredential(),
        subscription_id="ae640e6b-ba3e-4256-9d62-2993eecfa6f2",
    )

    response = client.policy_definitions.create_or_update(
        policy_definition_name="EventHubDiagnosticLogs",
        parameters={
            "properties": {
                "description": "Audit enabling of logs and retain them up to a year. This enables recreation of activity trails for investigation purposes when a security incident occurs or your network is compromised",
                "displayName": "Event Hubs should have diagnostic logging enabled",
                "metadata": {"category": "Event Hub"},
                "mode": "Indexed",
                "parameters": {
                    "requiredRetentionDays": {
                        "allowedValues": [0, 30, 90, 180, 365],
                        "defaultValue": 365,
                        "metadata": {
                            "description": "The required diagnostic logs retention in days",
                            "displayName": "Required retention (days)",
                        },
                        "type": "Integer",
                    }
                },
                "policyRule": {
                    "if": {"equals": "Microsoft.EventHub/namespaces", "field": "type"},
                    "then": {
                        "details": {
                            "existenceCondition": {
                                "allOf": [
                                    {
                                        "equals": "true",
                                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
                                    },
                                    {
                                        "equals": "[parameters('requiredRetentionDays')]",
                                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days",
                                    },
                                ]
                            },
                            "type": "Microsoft.Insights/diagnosticSettings",
                        },
                        "effect": "AuditIfNotExists",
                    },
                },
            }
        },
    )
    print(response)


# x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/createOrUpdatePolicyDefinitionAdvancedParams.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armpolicy_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armpolicy"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/219b2e3ef270f18149774eb2793b48baacde982f/specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/createOrUpdatePolicyDefinitionAdvancedParams.json
func ExampleDefinitionsClient_CreateOrUpdate_createOrUpdateAPolicyDefinitionWithAdvancedParameters() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armpolicy.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	_, err = clientFactory.NewDefinitionsClient().CreateOrUpdate(ctx, "EventHubDiagnosticLogs", armpolicy.Definition{
		Properties: &armpolicy.DefinitionProperties{
			Description: to.Ptr("Audit enabling of logs and retain them up to a year. This enables recreation of activity trails for investigation purposes when a security incident occurs or your network is compromised"),
			DisplayName: to.Ptr("Event Hubs should have diagnostic logging enabled"),
			Metadata: map[string]any{
				"category": "Event Hub",
			},
			Mode: to.Ptr("Indexed"),
			Parameters: map[string]*armpolicy.ParameterDefinitionsValue{
				"requiredRetentionDays": {
					Type: to.Ptr(armpolicy.ParameterTypeInteger),
					AllowedValues: []any{
						float64(0),
						float64(30),
						float64(90),
						float64(180),
						float64(365)},
					DefaultValue: float64(365),
					Metadata: &armpolicy.ParameterDefinitionsValueMetadata{
						Description: to.Ptr("The required diagnostic logs retention in days"),
						DisplayName: to.Ptr("Required retention (days)"),
					},
				},
			},
			PolicyRule: map[string]any{
				"if": map[string]any{
					"equals": "Microsoft.EventHub/namespaces",
					"field":  "type",
				},
				"then": map[string]any{
					"effect": "AuditIfNotExists",
					"details": map[string]any{
						"type": "Microsoft.Insights/diagnosticSettings",
						"existenceCondition": map[string]any{
							"allOf": []any{
								map[string]any{
									"equals": "true",
									"field":  "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
								},
								map[string]any{
									"equals": "[parameters('requiredRetentionDays')]",
									"field":  "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days",
								},
							},
						},
					},
				},
			},
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { PolicyClient } = require("@azure/arm-policy");
const { DefaultAzureCredential } = require("@azure/identity");
require("dotenv/config");

/**
 * This sample demonstrates how to This operation creates or updates a policy definition in the given subscription with the given name.
 *
 * @summary This operation creates or updates a policy definition in the given subscription with the given name.
 * x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/createOrUpdatePolicyDefinitionAdvancedParams.json
 */
async function createOrUpdateAPolicyDefinitionWithAdvancedParameters() {
  const subscriptionId =
    process.env["POLICY_SUBSCRIPTION_ID"] || "ae640e6b-ba3e-4256-9d62-2993eecfa6f2";
  const policyDefinitionName = "EventHubDiagnosticLogs";
  const parameters = {
    description:
      "Audit enabling of logs and retain them up to a year. This enables recreation of activity trails for investigation purposes when a security incident occurs or your network is compromised",
    displayName: "Event Hubs should have diagnostic logging enabled",
    metadata: { category: "Event Hub" },
    mode: "Indexed",
    parameters: {
      requiredRetentionDays: {
        type: "Integer",
        allowedValues: [0, 30, 90, 180, 365],
        defaultValue: 365,
        metadata: {
          description: "The required diagnostic logs retention in days",
          displayName: "Required retention (days)",
        },
      },
    },
    policyRule: {
      if: { equals: "Microsoft.EventHub/namespaces", field: "type" },
      then: {
        effect: "AuditIfNotExists",
        details: {
          type: "Microsoft.Insights/diagnosticSettings",
          existenceCondition: {
            allOf: [
              {
                equals: "true",
                field: "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
              },
              {
                equals: "[parameters('requiredRetentionDays')]",
                field: "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days",
              },
            ],
          },
        },
      },
    },
  };
  const credential = new DefaultAzureCredential();
  const client = new PolicyClient(credential, subscriptionId);
  const result = await client.policyDefinitions.createOrUpdate(policyDefinitionName, parameters);
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Пример ответа

Код состояния:: 201

{
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "ResourceNaming",
  "properties": {
    "mode": "Indexed",
    "displayName": "Event Hubs should have diagnostic logging enabled",
    "description": "Audit enabling of logs and retain them up to a year. This enables recreation of activity trails for investigation purposes when a security incident occurs or your network is compromised",
    "metadata": {
      "category": "Event Hub"
    },
    "version": "1.2.1",
    "versions": [
      "1.2.1",
      "1.0.0"
    ],
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.EventHub/namespaces"
      },
      "then": {
        "effect": "AuditIfNotExists",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.enabled",
                "equals": "true"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs[*].retentionPolicy.days",
                "equals": "[parameters('requiredRetentionDays')]"
              }
            ]
          }
        }
      }
    },
    "parameters": {
      "requiredRetentionDays": {
        "type": "Integer",
        "defaultValue": 365,
        "allowedValues": [
          0,
          30,
          90,
          180,
          365
        ],
        "metadata": {
          "displayName": "Required retention (days)",
          "description": "The required diagnostic logs retention in days"
        }
      }
    }
  }
}

Определения

Имя	Описание
CloudError	Ответ на ошибку из операции политики.
createdByType	Тип удостоверения, создавшего ресурс.
ErrorAdditionalInfo	Дополнительные сведения об ошибке управления ресурсами.
ErrorResponse	Ответ на ошибку
Metadata	Общие метаданные параметра.
ParameterDefinitionsValue	Определение параметра, который может быть предоставлен политике.
parameterType	Тип данных параметра.
PolicyDefinition	Определение политики.
policyType	Тип определения политики. Возможные значения: NotSpecified, BuiltIn, Custom и Static.
systemData	Метаданные, относящиеся к созданию и последнему изменении ресурса.

CloudError

Object

Ответ на ошибку из операции политики.

Имя	Тип	Описание
error	ErrorResponse	Ответ на ошибку Распространенный ответ об ошибке для всех API Azure Resource Manager для возврата сведений об ошибке для неудачных операций. (Это также следует формату ответа на ошибку OData.)

createdByType

Перечисление

Тип удостоверения, создавшего ресурс.

Значение	Описание
User
Application
ManagedIdentity
Key

ErrorAdditionalInfo

Object

Дополнительные сведения об ошибке управления ресурсами.

Имя	Тип	Описание
info	object	Дополнительные сведения.
type	string	Дополнительный тип сведений.

ErrorResponse

Object

Ответ на ошибку

Имя	Тип	Описание
additionalInfo	ErrorAdditionalInfo[]	Дополнительные сведения об ошибке.
code	string	Код ошибки.
details	ErrorResponse[]	Сведения об ошибке.
message	string	Сообщение об ошибке.
target	string	Целевой объект ошибки.

Metadata

Object

Общие метаданные параметра.

Имя	Тип	Описание
assignPermissions	boolean	Задайте значение true, чтобы портал Azure создавал назначения ролей для идентификатора ресурса или значения области ресурса этого параметра во время назначения политики. Это свойство полезно, если вы хотите назначить разрешения за пределами области назначения.
description	string	Описание параметра.
displayName	string	Отображаемое имя параметра.
strongType	string	Используется при назначении определения политики через портал. Предоставляет контекстный список значений, которые пользователь выбирает.

ParameterDefinitionsValue

Object

Определение параметра, который может быть предоставлен политике.

Имя	Тип	Описание
allowedValues	object[]	Допустимые значения параметра.
defaultValue	object	Значение по умолчанию для параметра, если значение не указано.
metadata	Metadata	Общие метаданные параметра.
schema	object	Обеспечивает проверку входных данных параметров во время назначения с помощью самоопределимой схемы JSON. Это свойство поддерживается только для параметров типа объекта и следует реализации Json.NET schema 2019-09. Дополнительные сведения об использовании схем см. в https://json-schema.org/ и тестировании черновиков схем на https://www.jsonschemavalidator.net/.
type	parameterType	Тип данных параметра.

parameterType

Перечисление

Тип данных параметра.

Значение	Описание
String
Array
Object
Boolean
Integer
Float
DateTime