policy config_error ai_generated true

Resource 'myresource' was disallowed by policy. Policy: 'Inherit a tag from the resource group if missing'. Reason: 'The resource has no tags.'

ID: policy/azure-policy-tag-inheritance-failure

Also available as: JSON · Markdown · 中文
80%Fix Rate
84%Confidence
1Evidence
2024-06-12First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Azure Policy v1.0 active — — —
Azure Resource Manager 2023-03-01 active — — —
Terraform AzureRM Provider v3.90.0 active — — —

Root Cause

Azure Policy 'Inherit a tag from the resource group if missing' requires resources to have at least the inherited tag, but the policy engine fails to apply inheritance if the resource group itself lacks the tag or if the resource is created before the policy assignment.

generic

中文

Azure 策略 '如果缺少标签，从资源组继承标签' 要求资源至少具有继承的标签，但如果资源组本身缺少标签或资源在策略分配之前创建，策略引擎无法应用继承。

Official Documentation

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#modify

Workarounds

  1. 85% success Ensure the resource group has the required tag before creating the resource: az tag update --resource-id /subscriptions/<sub>/resourceGroups/<rg> --tags Environment=Production. Then retry resource creation. 
    Ensure the resource group has the required tag before creating the resource: az tag update --resource-id /subscriptions/<sub>/resourceGroups/<rg> --tags Environment=Production. Then retry resource creation.
  2. 75% success Create a policy exemption for the specific resource or resource group via Azure Portal: Policy > Compliance > select policy > Create exemption. 
    Create a policy exemption for the specific resource or resource group via Azure Portal: Policy > Compliance > select policy > Create exemption.
  3. 80% success Use a deployment script to retroactively apply tags to existing resources: az resource tag --tags Environment=Production --ids <resource-id>. 
    Use a deployment script to retroactively apply tags to existing resources: az resource tag --tags Environment=Production --ids <resource-id>.

中文步骤

  1. 确保资源组在创建资源之前具有所需标签：az tag update --resource-id /subscriptions/<sub>/resourceGroups/<rg> --tags Environment=Production。然后重试资源创建。
  2. 通过 Azure 门户为特定资源或资源组创建策略豁免：策略 > 合规性 > 选择策略 > 创建豁免。
  3. 使用部署脚本追溯性地将标签应用于现有资源：az resource tag --tags Environment=Production --ids <resource-id>。

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Adding a tag to the resource manually via portal does not resolve the policy violation because the policy expects automatic inheritance from the resource group.

  2. 80% fail

    Deleting and recreating the resource without ensuring the resource group has the tag still results in the same error.

  3. 90% fail

    Disabling the policy globally is not allowed for non-admin users and may violate organizational compliance.