# 资源'myresource'被策略禁止。策略：'允许的位置'。原因：'资源位置'eastus2'不被允许。'

- **ID:** `policy/azure-policy-denies-resource-group-location-mismatch`
- **领域:** policy
- **类别:** config_error
- **错误码:** `PolicyViolation`
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

Azure策略'允许的位置'将资源部署限制在预定义的区域列表中，而资源的位置与任何允许的区域都不匹配。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Azure Policy 2.0 | active | — | — |
| Azure Resource Manager 2023-03-01 | active | — | — |

## 解决方案

1. ```
   Identify the allowed locations from the policy assignment and redeploy the resource to one of those regions. Use Azure CLI: `az policy assignment list --query "[?policyDefinitionId=='/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c'].{name:name, parameters:parameters}"` to get the allowed list.
   ```
2. ```
   Create an exemption for the resource group or specific resource via Azure Portal: Policy > Compliance > Select policy > Create exemption. This bypasses the policy for that scope.
   ```
3. ```
   Modify the policy assignment to include the desired location by updating the parameters: `az policy assignment update --name "allowed-locations" --resource-group "my-rg" --parameters "{\"listOfAllowedLocations\":{\"value\":[\"eastus\",\"eastus2\"]}}"`.
   ```

## 无效尝试

- **** — The policy may apply to multiple resource groups or subscriptions; changing location randomly may still violate the policy if the new location is also not allowed. (60% 失败率)
- **** — The policy is evaluated at deployment time; recreating in the same disallowed location will trigger the same denial. (80% 失败率)
- **** — The policy is enforced by Azure Resource Manager; retrying without changing the location will consistently fail. (95% 失败率)