Policy Definitions - List Built In

參考

服務:: Policy

API 版本:: 2023-04-01

擷取內建原則定義
此作業會擷取符合選擇性指定$filter之所有內建原則定義的清單。如果提供 $filter='policyType -eq {value}' ，則傳回的列表只會包含類型符合 {value} 的所有內建原則定義。可能的 policyType 值為 NotSpecified、BuiltIn、Custom 和 Static。如果提供 $filter='category -eq {value}' ，則傳回的清單只會包含所有符合 {value} 類別的內建原則定義。

GET https://management.azure.com/providers/Microsoft.Authorization/policyDefinitions?api-version=2023-04-01

含選擇性參數:

GET https://management.azure.com/providers/Microsoft.Authorization/policyDefinitions?api-version=2023-04-01&$filter={$filter}&$top={$top}

URI 參數

名稱	位於	必要	類型	Description
api-version	query	True	string minLength: 1	要用於這項作業的 API 版本。
$filter	query		string	要套用至作業的篩選條件。 $filter的有效值為：'atExactScope（）'、'policyType -eq {value}' 或 'category eq '{value}''。如果未提供$filter，則不會執行任何篩選。如果提供 $filter=atExactScope（），則傳回的清單只會包含指定範圍內的所有原則定義。如果提供 $filter='policyType -eq {value}' ，則傳回的列表只會包含類型符合 {value} 的所有原則定義。可能的 policyType 值為 NotSpecified、BuiltIn、Custom 和 Static。如果提供 $filter='category -eq {value}' ，則傳回的清單只會包含類別符合 {value} 的所有原則定義。
$top	query		integer (int32) minimum: 1 maximum: 1000	要傳回的記錄數目上限。未提供$top篩選時，它會傳回 500 筆記錄。

回應

名稱	類型	Description
200 OK	PolicyDefinitionListResult	確定 - 傳回內建原則定義的陣列。
Other Status Codes	CloudError	描述作業失敗原因的錯誤回應。

安全性

azure_auth

Azure Active Directory OAuth2 Flow。

類型: oauth2
Flow: implicit
授權 URL: https://login.microsoftonline.com/common/oauth2/authorize

範圍

名稱	Description
user_impersonation	模擬您的用戶帳戶

範例

List built-in policy definitions

範例要求

GET https://management.azure.com/providers/Microsoft.Authorization/policyDefinitions?api-version=2023-04-01


/**
 * Samples for PolicyDefinitions ListBuiltIn.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/
     * listBuiltInPolicyDefinitions.json
     */
    /**
     * Sample code: List built-in policy definitions.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void listBuiltInPolicyDefinitions(com.azure.resourcemanager.AzureResourceManager azure) {
        azure.genericResources().manager().policyClient().getPolicyDefinitions().listBuiltIn(null, null,
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.resource import PolicyClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-resource
# USAGE
    python list_built_in_policy_definitions.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = PolicyClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.policy_definitions.list_built_in()
    for item in response:
        print(item)


# x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/listBuiltInPolicyDefinitions.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armpolicy_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armpolicy"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/219b2e3ef270f18149774eb2793b48baacde982f/specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/listBuiltInPolicyDefinitions.json
func ExampleDefinitionsClient_NewListBuiltInPager() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armpolicy.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewDefinitionsClient().NewListBuiltInPager(&armpolicy.DefinitionsClientListBuiltInOptions{Filter: nil,
		Top: nil,
	})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.DefinitionListResult = armpolicy.DefinitionListResult{
		// 	Value: []*armpolicy.Definition{
		// 		{
		// 			Name: to.Ptr("06a78e20-9358-41c9-923c-fb736d382a12"),
		// 			Type: to.Ptr("Microsoft.Authorization/policyDefinitions"),
		// 			ID: to.Ptr("/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a12"),
		// 			Properties: &armpolicy.DefinitionProperties{
		// 				Description: to.Ptr("Audit DB level audit setting for SQL databases"),
		// 				DisplayName: to.Ptr("Audit SQL DB Level Audit Setting"),
		// 				Mode: to.Ptr("All"),
		// 				Parameters: map[string]*armpolicy.ParameterDefinitionsValue{
		// 					"setting": &armpolicy.ParameterDefinitionsValue{
		// 						Type: to.Ptr(armpolicy.ParameterTypeString),
		// 						AllowedValues: []any{
		// 							"enabled",
		// 							"disabled"},
		// 							Metadata: &armpolicy.ParameterDefinitionsValueMetadata{
		// 								DisplayName: to.Ptr("Audit Setting"),
		// 							},
		// 						},
		// 					},
		// 					PolicyRule: map[string]any{
		// 						"if":map[string]any{
		// 							"equals": "Microsoft.Sql/servers/databases",
		// 							"field": "type",
		// 						},
		// 						"then":map[string]any{
		// 							"effect": "AuditIfNotExists",
		// 							"details":map[string]any{
		// 								"name": "default",
		// 								"type": "Microsoft.Sql/servers/databases/auditingSettings",
		// 								"existenceCondition":map[string]any{
		// 									"allOf":[]any{
		// 										map[string]any{
		// 											"equals": "[parameters('setting')]",
		// 											"field": "Microsoft.Sql/auditingSettings.state",
		// 										},
		// 									},
		// 								},
		// 							},
		// 						},
		// 					},
		// 					PolicyType: to.Ptr(armpolicy.PolicyTypeBuiltIn),
		// 					Version: to.Ptr("1.2.1"),
		// 					Versions: []*string{
		// 						to.Ptr("1.2.1"),
		// 						to.Ptr("1.0.0")},
		// 					},
		// 				},
		// 				{
		// 					Name: to.Ptr("7433c107-6db4-4ad1-b57a-a76dce0154a1"),
		// 					Type: to.Ptr("Microsoft.Authorization/policyDefinitions"),
		// 					ID: to.Ptr("/providers/Microsoft.Authorization/policyDefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1"),
		// 					Properties: &armpolicy.DefinitionProperties{
		// 						Description: to.Ptr("This policy enables you to specify a set of storage account SKUs that your organization can deploy."),
		// 						DisplayName: to.Ptr("Allowed storage account SKUs"),
		// 						Mode: to.Ptr("All"),
		// 						Parameters: map[string]*armpolicy.ParameterDefinitionsValue{
		// 							"listOfAllowedSKUs": &armpolicy.ParameterDefinitionsValue{
		// 								Type: to.Ptr(armpolicy.ParameterTypeArray),
		// 								Metadata: &armpolicy.ParameterDefinitionsValueMetadata{
		// 									Description: to.Ptr("The list of SKUs that can be specified for storage accounts."),
		// 									DisplayName: to.Ptr("Allowed SKUs"),
		// 									StrongType: to.Ptr("StorageSKUs"),
		// 								},
		// 							},
		// 						},
		// 						PolicyRule: map[string]any{
		// 							"if":map[string]any{
		// 								"allOf":[]any{
		// 									map[string]any{
		// 										"equals": "Microsoft.Storage/storageAccounts",
		// 										"field": "type",
		// 									},
		// 									map[string]any{
		// 										"not":map[string]any{
		// 											"field": "Microsoft.Storage/storageAccounts/sku.name",
		// 											"in": "[parameters('listOfAllowedSKUs')]",
		// 										},
		// 									},
		// 								},
		// 							},
		// 							"then":map[string]any{
		// 								"effect": "Deny",
		// 							},
		// 						},
		// 						PolicyType: to.Ptr(armpolicy.PolicyTypeStatic),
		// 						Version: to.Ptr("1.2.1"),
		// 						Versions: []*string{
		// 							to.Ptr("1.2.1"),
		// 							to.Ptr("1.0.0")},
		// 						},
		// 					},
		// 					{
		// 						Name: to.Ptr("abeed54a-73c5-441d-8a8c-6b5e7a0c299e"),
		// 						Type: to.Ptr("Microsoft.Authorization/policyDefinitions"),
		// 						ID: to.Ptr("/providers/Microsoft.Authorization/policyDefinitions/abeed54a-73c5-441d-8a8c-6b5e7a0c299e"),
		// 						Properties: &armpolicy.DefinitionProperties{
		// 							Description: to.Ptr("Audit certificates that are stored in Azure Key Vault, that expire within 'X' number of days."),
		// 							DisplayName: to.Ptr("Audit KeyVault certificates that expire within specified number of days"),
		// 							Metadata: map[string]any{
		// 								"category": "KeyVault DataPlane",
		// 							},
		// 							Mode: to.Ptr("Microsoft.KeyVault.Data"),
		// 							Parameters: map[string]*armpolicy.ParameterDefinitionsValue{
		// 								"daysToExpire": &armpolicy.ParameterDefinitionsValue{
		// 									Type: to.Ptr(armpolicy.ParameterTypeInteger),
		// 									Metadata: &armpolicy.ParameterDefinitionsValueMetadata{
		// 										Description: to.Ptr("The number of days for a certificate to expire."),
		// 										DisplayName: to.Ptr("Days to expire"),
		// 									},
		// 								},
		// 							},
		// 							PolicyRule: map[string]any{
		// 								"if":map[string]any{
		// 									"field": "Microsoft.KeyVault.Data/vaults/certificates/attributes/expiresOn",
		// 									"lessOrEquals": "[addDays(utcNow(), parameters('daysToExpire'))]",
		// 								},
		// 								"then":map[string]any{
		// 									"effect": "audit",
		// 								},
		// 							},
		// 							PolicyType: to.Ptr(armpolicy.PolicyTypeBuiltIn),
		// 							Version: to.Ptr("1.2.1"),
		// 							Versions: []*string{
		// 								to.Ptr("1.2.1"),
		// 								to.Ptr("1.0.0")},
		// 							},
		// 					}},
		// 				}
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { PolicyClient } = require("@azure/arm-policy");
const { DefaultAzureCredential } = require("@azure/identity");
require("dotenv/config");

/**
 * This sample demonstrates how to This operation retrieves a list of all the built-in policy definitions that match the optional given $filter. If $filter='policyType -eq {value}' is provided, the returned list only includes all built-in policy definitions whose type match the {value}. Possible policyType values are NotSpecified, BuiltIn, Custom, and Static. If $filter='category -eq {value}' is provided, the returned list only includes all built-in policy definitions whose category match the {value}.
 *
 * @summary This operation retrieves a list of all the built-in policy definitions that match the optional given $filter. If $filter='policyType -eq {value}' is provided, the returned list only includes all built-in policy definitions whose type match the {value}. Possible policyType values are NotSpecified, BuiltIn, Custom, and Static. If $filter='category -eq {value}' is provided, the returned list only includes all built-in policy definitions whose category match the {value}.
 * x-ms-original-file: specification/resources/resource-manager/Microsoft.Authorization/stable/2023-04-01/examples/listBuiltInPolicyDefinitions.json
 */
async function listBuiltInPolicyDefinitions() {
  const credential = new DefaultAzureCredential();
  const client = new PolicyClient(credential);
  const resArray = new Array();
  for await (const item of client.policyDefinitions.listBuiltIn()) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

範例回覆

狀態碼:: 200

{
  "value": [
    {
      "properties": {
        "mode": "All",
        "displayName": "Audit SQL DB Level Audit Setting",
        "policyType": "BuiltIn",
        "description": "Audit DB level audit setting for SQL databases",
        "parameters": {
          "setting": {
            "type": "String",
            "metadata": {
              "displayName": "Audit Setting"
            },
            "allowedValues": [
              "enabled",
              "disabled"
            ]
          }
        },
        "version": "1.2.1",
        "versions": [
          "1.2.1",
          "1.0.0"
        ],
        "policyRule": {
          "if": {
            "field": "type",
            "equals": "Microsoft.Sql/servers/databases"
          },
          "then": {
            "effect": "AuditIfNotExists",
            "details": {
              "type": "Microsoft.Sql/servers/databases/auditingSettings",
              "name": "default",
              "existenceCondition": {
                "allOf": [
                  {
                    "field": "Microsoft.Sql/auditingSettings.state",
                    "equals": "[parameters('setting')]"
                  }
                ]
              }
            }
          }
        }
      },
      "id": "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a12",
      "type": "Microsoft.Authorization/policyDefinitions",
      "name": "06a78e20-9358-41c9-923c-fb736d382a12"
    },
    {
      "properties": {
        "mode": "All",
        "displayName": "Allowed storage account SKUs",
        "policyType": "Static",
        "description": "This policy enables you to specify a set of storage account SKUs that your organization can deploy.",
        "parameters": {
          "listOfAllowedSKUs": {
            "type": "Array",
            "metadata": {
              "description": "The list of SKUs that can be specified for storage accounts.",
              "displayName": "Allowed SKUs",
              "strongType": "StorageSKUs"
            }
          }
        },
        "version": "1.2.1",
        "versions": [
          "1.2.1",
          "1.0.0"
        ],
        "policyRule": {
          "if": {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Storage/storageAccounts"
              },
              {
                "not": {
                  "field": "Microsoft.Storage/storageAccounts/sku.name",
                  "in": "[parameters('listOfAllowedSKUs')]"
                }
              }
            ]
          },
          "then": {
            "effect": "Deny"
          }
        }
      },
      "id": "/providers/Microsoft.Authorization/policyDefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1",
      "type": "Microsoft.Authorization/policyDefinitions",
      "name": "7433c107-6db4-4ad1-b57a-a76dce0154a1"
    },
    {
      "properties": {
        "mode": "Microsoft.KeyVault.Data",
        "displayName": "Audit KeyVault certificates that expire within specified number of days",
        "policyType": "BuiltIn",
        "description": "Audit certificates that are stored in Azure Key Vault, that expire within 'X' number of days.",
        "metadata": {
          "category": "KeyVault DataPlane"
        },
        "parameters": {
          "daysToExpire": {
            "type": "Integer",
            "metadata": {
              "displayName": "Days to expire",
              "description": "The number of days for a certificate to expire."
            }
          }
        },
        "version": "1.2.1",
        "versions": [
          "1.2.1",
          "1.0.0"
        ],
        "policyRule": {
          "if": {
            "field": "Microsoft.KeyVault.Data/vaults/certificates/attributes/expiresOn",
            "lessOrEquals": "[addDays(utcNow(), parameters('daysToExpire'))]"
          },
          "then": {
            "effect": "audit"
          }
        }
      },
      "id": "/providers/Microsoft.Authorization/policyDefinitions/abeed54a-73c5-441d-8a8c-6b5e7a0c299e",
      "type": "Microsoft.Authorization/policyDefinitions",
      "name": "abeed54a-73c5-441d-8a8c-6b5e7a0c299e"
    }
  ]
}

定義

名稱	Description
CloudError	原則作業的錯誤回應。
createdByType	建立資源的身分識別類型。
ErrorAdditionalInfo	資源管理錯誤其他資訊。
ErrorResponse	錯誤回應
Metadata	參數的一般元數據。
ParameterDefinitionsValue	可提供給原則的參數定義。
parameterType	參數的數據類型。
PolicyDefinition	原則定義。
PolicyDefinitionListResult	原則定義清單。
policyType	原則定義的類型。可能的值為 NotSpecified、BuiltIn、Custom 和 Static。
systemData	與建立和上次修改資源相關的元數據。

CloudError

Object

原則作業的錯誤回應。

名稱	類型	Description
error	ErrorResponse	錯誤回應所有 Azure Resource Manager API 的常見錯誤回應，以傳回失敗作業的錯誤詳細數據。（這也遵循 OData 錯誤回應格式。）

createdByType

列舉型別

建立資源的身分識別類型。

值	Description
Application
Key
ManagedIdentity
User

ErrorAdditionalInfo

Object

資源管理錯誤其他資訊。

名稱	類型	Description
info	object	其他資訊。
type	string	其他信息類型。

ErrorResponse

Object

錯誤回應

名稱	類型	Description
additionalInfo	ErrorAdditionalInfo[]	錯誤其他資訊。
code	string	錯誤碼。
details	ErrorResponse[]	錯誤詳細數據。
message	string	錯誤訊息。
target	string	錯誤目標。

Metadata

Object

參數的一般元數據。

名稱	類型	Description
assignPermissions	boolean	設定為 true，讓 Azure 入口網站在原則指派期間，於此參數的資源標識碼或資源範圍值上建立角色指派。如果您想要在指派範圍之外指派許可權，這個屬性就很有用。
description	string	參數的描述。
displayName	string	參數的顯示名稱。
strongType	string	透過入口網站指派原則定義時使用。提供內容感知值清單，供用戶選擇。

ParameterDefinitionsValue

Object

可提供給原則的參數定義。

名稱	類型	Description
allowedValues	object[]	參數的允許值。
defaultValue	object	如果未提供任何值，則為參數的預設值。
metadata	Metadata	參數的一般元數據。
schema	object	使用自我定義 JSON 架構，在指派期間提供參數輸入的驗證。此屬性僅支持物件類型參數，並遵循架構 2019-09 實作 Json.NET。您可以在 https://json-schema.org/ 深入瞭解如何使用架構，並在 https://www.jsonschemavalidator.net/測試草稿架構。
type	parameterType	參數的數據類型。

parameterType

列舉型別

參數的數據類型。

值	Description
Array
Boolean
DateTime
Float
Integer
Object
String