policy config_error ai_generated true

资源 'myresource' 被策略禁止。策略：'如果缺少标签，从资源组继承标签'。原因：'资源没有标签。'

Resource 'myresource' was disallowed by policy. Policy: 'Inherit a tag from the resource group if missing'. Reason: 'The resource has no tags.'

ID: policy/azure-policy-tag-inheritance-failure

其他格式: JSON · Markdown 中文 · English
80%修复率
84%置信度
1证据数
2024-06-12首次发现

版本兼容性

版本状态引入弃用备注
Azure Policy v1.0 active — — —
Azure Resource Manager 2023-03-01 active — — —
Terraform AzureRM Provider v3.90.0 active — — —

根因分析

Azure 策略 '如果缺少标签，从资源组继承标签' 要求资源至少具有继承的标签，但如果资源组本身缺少标签或资源在策略分配之前创建，策略引擎无法应用继承。

English

Azure Policy 'Inherit a tag from the resource group if missing' requires resources to have at least the inherited tag, but the policy engine fails to apply inheritance if the resource group itself lacks the tag or if the resource is created before the policy assignment.

generic

官方文档

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#modify

解决方案

  1. 确保资源组在创建资源之前具有所需标签：az tag update --resource-id /subscriptions/<sub>/resourceGroups/<rg> --tags Environment=Production。然后重试资源创建。
  2. 通过 Azure 门户为特定资源或资源组创建策略豁免：策略 > 合规性 > 选择策略 > 创建豁免。
  3. 使用部署脚本追溯性地将标签应用于现有资源：az resource tag --tags Environment=Production --ids <resource-id>。

无效尝试

常见但无效的做法:

  1. 70% 失败

    Adding a tag to the resource manually via portal does not resolve the policy violation because the policy expects automatic inheritance from the resource group.

  2. 80% 失败

    Deleting and recreating the resource without ensuring the resource group has the tag still results in the same error.

  3. 90% 失败

    Disabling the policy globally is not allowed for non-admin users and may violate organizational compliance.