您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

快速入门:在门户中定义和分配蓝图Quickstart: Define and assign a blueprint in the portal

了解如何创建和分配蓝图时,可以定义常见的模式,以便根据 Azure 资源管理器模板、策略、安全性等方面的要求开发可重复使用和可快速部署的配置。When you learn how to create and assign blueprints, you can define common patterns to develop reusable and rapidly deployable configurations based on Azure Resource Manager templates, policy, security, and more. 本教程介绍如何使用 Azure 蓝图来执行某些与在组织中创建、发布和分配蓝图相关的常见任务。In this tutorial, you learn to use Azure Blueprints to do some of the common tasks related to creating, publishing, and assigning a blueprint within your organization. 这些任务包括:These tasks include:

  • 新建蓝图并添加各种受支持的项目Create a new blueprint and add various supported artifacts
  • 对仍处于“草稿”状态的现有蓝图进行更改 Make changes to an existing blueprint still in Draft
  • 使用“已发布”将蓝图标记为分配就绪 Mark a blueprint as ready to assign with Published
  • 向现有订阅分配蓝图Assign a blueprint to an existing subscription
  • 检查已分配蓝图的状态和进度Check the status and progress of an assigned blueprint
  • 删除已向订阅分配的蓝图Remove a blueprint that has been assigned to a subscription

如果没有 Azure 订阅,请在开始之前创建一个免费帐户If you don't have an Azure subscription, create a free account before you begin.

创建蓝图Create a blueprint

定义符合性的标准模式的第一步是根据可用资源构建蓝图。The first step in defining a standard pattern for compliance is to compose a blueprint from the available resources. 本示例将创建名为 MyBlueprint 的新蓝图,以配置订阅的角色和策略分配。In this example, create a new blueprint named MyBlueprint to configure role and policy assignments for the subscription. 然后,将添加新的资源组,并在该资源组中创建资源管理器模板和角色分配。Then add a new resource group, and create a Resource Manager template and role assignment on the new resource group.

  1. 在左侧窗格中,选择“所有服务” 。Select All services in the left pane. 搜索并选择“蓝图” 。Search for and select Blueprints.

  2. 从左侧页面选择“蓝图定义”,然后选择页面顶部的“+ 创建蓝图”按钮 。Select Blueprint definitions from the page on the left and select the + Create blueprint button at the top of the page.

    或者,选择“入门” 页上的“创建” ,直接创建一个蓝图。Or, select Create from the Getting started page to go straight to creating a blueprint.

    在“蓝图定义”页中创建蓝图

  3. 提供蓝图名称,例如 MyBlueprintProvide a Blueprint name such as MyBlueprint. (最多使用 48 个字母和数字,但不要包含空格或特殊字符)。(Use up to 48 letters and numbers, but no spaces or special characters). 暂时将“蓝图说明”留空 。Leave Blueprint description blank for now.

  4. 在“定义位置”框中,选择右侧的省略号,选择要在其中保存蓝图的管理组或订阅,然后选择“选择” 。In the Definition location box, select the ellipsis on the right, select the management group or subscription where you want to save the blueprint, and choose Select.

  5. 确认信息是否正确。Verify that the information is correct. 稍后无法更改“蓝图名称”和“定义位置”字段 。The Blueprint name and Definition location fields can't be changed later. 然后选择页面底部的“下一步: 项目”或页面顶部的“项目”选项卡 。Then select Next : Artifacts at the bottom of the page or the Artifacts tab at the top of the page.

  6. 添加订阅级别的角色分配:Add a role assignment at the subscription level:

    1. 在“订阅”下选择“+ 添加项目”行 。Select the + Add artifact row under Subscription. 随即会在浏览器右侧打开“添加项目”窗口 。The Add artifact window opens on the right side of the browser.

    2. 为“项目类型”选择“角色分配” 。Select Role assignment for Artifact type.

    3. 在“角色”下,选择“参与者” 。Under Role, select Contributor. 保留选中“添加用户、应用或组”框,指示使用动态参数 。Leave the Add user, app or group box with the check box that indicates a dynamic parameter.

    4. 选择“添加” 将此项目添加到蓝图中。Select Add to add this artifact to the blueprint.

    蓝图项目的角色分配

    备注

    大多数项目支持参数。Most artifacts support parameters. 在蓝图创建期间为其分配值的参数是静态参数 。A parameter that's assigned a value during blueprint creation is a static parameter. 如果在蓝图分配期间分配参数,则该参数是动态参数 。If the parameter is assigned during blueprint assignment, it's a dynamic parameter. 有关更多信息,请参阅蓝图参数For more information, see Blueprint parameters.

  7. 添加订阅级别的策略分配:Add a policy assignment at the subscription level:

    1. 选择角色分配项目下的“+ 添加项目”行 。Select the + Add artifact row under the role assignment artifact.

    2. 为“项目类型”选择“策略分配” 。Select Policy assignment for Artifact type.

    3. 将“类型”更改为“内置” 。Change Type to Built-in. 在“搜索”中输入 tagIn Search, enter tag.

    4. 单击“搜索” 以进行筛选。Click out of Search for the filtering to occur. 选择“对资源组追加标记及其默认值” 。Select Append tag and its default value to resource groups.

    5. 选择“添加” 将此项目添加到蓝图中。Select Add to add this artifact to the blueprint.

  8. 选择策略分配行“对资源组追加标记及其默认值”。 Select the row of the policy assignment Append tag and its default value to resource groups.

  9. 随即将打开作为蓝图定义一部分的向项目提供参数的窗口,并允许基于此蓝图而不是在分配期间(动态参数)设置所有分配的参数(静态参数)。The window to provide parameters to the artifact as part of the blueprint definition opens and allows setting the parameters for all assignments (static parameters) based on this blueprint instead of during assignment (dynamic parameters). 此示例在蓝图分配期间使用动态参数,因此请保留默认值并选择“取消” 。This example uses dynamic parameters during blueprint assignment, so leave the defaults and select Cancel.

  10. 添加订阅级别的资源组:Add a resource group at the subscription level:

    1. 在“订阅”下选择“+ 添加项目”行 。Select the + Add artifact row under Subscription.

    2. 为“项目类型”选择“资源组” 。Select Resource group for Artifact type.

    3. 将“项目显示名称”、“资源组名称”和“位置”框留空,但请确保在每个参数属性上选中该复选框,以使其成为动态参数 。Leave the Artifact display name, Resource Group Name, and Location boxes blank, but make sure that the check box is checked for each parameter property to make them dynamic parameters.

    4. 选择“添加” 将此项目添加到蓝图中。Select Add to add this artifact to the blueprint.

  11. 在资源组下添加模板:Add a template under the resource group:

    1. 在“ResourceGroup”条目下选择“+ 添加项目”行 。Select the + Add artifact row under the ResourceGroup entry.

    2. 为“项目类型”选择“Azure 资源管理器模板”,将“项目显示名称”设置为“StorageAccount”,并将“说明”保留为空 。Select Azure Resource Manager template for Artifact type, set Artifact display name to StorageAccount, and leave Description blank.

    3. 在编辑器框的“模板” 选项卡上,粘贴以下资源管理器模板。On the Template tab in the editor box, paste the following Resource Manager template. 粘贴模板后,选择“参数”选项卡,并注意已检测到模板参数 storageAccountType 和 location 。After you paste the template, select the Parameters tab and note that the template parameters storageAccountType and location were detected. 将自动检测并填充每个参数,但将其配置为“动态参数”。Each parameter was automatically detected and populated, but configured as a dynamic parameter.

      重要

      如果导入模板,请确保该文件仅为 JSON 且不包含 HTML。If you're importing the template, ensure that the file is only JSON and doesn't include HTML. 当指向 GitHub 上的 URL 时,请确保已选择“RAW” 以获取纯 JSON 文件,而不是用 HTML 包装在 GitHub 上显示的文件。When you're pointing to a URL on GitHub, ensure that you have selected RAW to get the pure JSON file and not the one wrapped with HTML for display on GitHub. 如果导入的模板不是纯 JSON,则会出现错误。An error occurs if the imported template is not purely JSON.

      {
          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
              "storageAccountType": {
                  "type": "string",
                  "defaultValue": "Standard_LRS",
                  "allowedValues": [
                      "Standard_LRS",
                      "Standard_GRS",
                      "Standard_ZRS",
                      "Premium_LRS"
                  ],
                  "metadata": {
                      "description": "Storage Account type"
                  }
              },
              "location": {
                  "type": "string",
                  "defaultValue": "[resourceGroup().location]",
                  "metadata": {
                      "description": "Location for all resources."
                  }
              }
          },
          "variables": {
              "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]"
          },
          "resources": [{
              "type": "Microsoft.Storage/storageAccounts",
              "name": "[variables('storageAccountName')]",
              "location": "[parameters('location')]",
              "apiVersion": "2018-07-01",
              "sku": {
                  "name": "[parameters('storageAccountType')]"
              },
              "kind": "StorageV2",
              "properties": {}
          }],
          "outputs": {
              "storageAccountName": {
                  "type": "string",
                  "value": "[variables('storageAccountName')]"
              }
          }
      }
      
    4. 清除该 storageAccountType 复选框,并请注意,下拉列表仅包含 allowedValues 下的资源管理器模板中包含的值 。Clear the storageAccountType check box and note that the drop-down list contains only values included in the Resource Manager template under allowedValues. 选中此框将其重新设置为动态参数。Select the box to set it back to a dynamic parameter.

    5. 选择“添加” 将此项目添加到蓝图中。Select Add to add this artifact to the blueprint.

    蓝图项目的资源管理器模板

  12. 已完成的蓝图应如下所示:Your completed blueprint should look similar to the following. 请注意,每个项目在“参数”列下都显示“已填充 y 个参数中的 x 个”。 Notice that each artifact has x out of y parameters populated in the Parameters column. 动态参数在每次分配蓝图期间设置。The dynamic parameters are set during each assignment of the blueprint.

    完成的蓝图定义

  13. 现在已添加所有计划项目,请选择页面底部的“保存草稿” 。Now that all planned artifacts have been added, select Save Draft at the bottom of the page.

编辑蓝图Edit a blueprint

创建蓝图中,未提供说明,也未将角色分配添加到新资源组。In Create a blueprint, you didn't provide a description or add the role assignment to the new resource group. 二者都可按以下步骤修复:You can fix both by following these steps:

  1. 从左侧页面中选择“蓝图定义” 。Select Blueprint definitions from the page on the left.

  2. 在蓝图列表中,右键单击之前创建的蓝图,然后选择“编辑蓝图” 。In the list of blueprints, right-click the one that you previously created and select Edit blueprint.

  3. 在“蓝图说明”中,提供有关蓝图和组成它的项目的一些信息 。In Blueprint description, provide some information about the blueprint and the artifacts that compose it. 在本示例中,输入如下内容:“此蓝图在订阅上设置标记策略和角色分配,创建 ResourceGroup,并将资源模板和角色分配部署到该 ResourceGroup。” In this case, enter something like: This blueprint sets tag policy and role assignment on the subscription, creates a ResourceGroup, and deploys a resource template and role assignment to that ResourceGroup.

  4. 选择“下一步: 项目”或页面顶部的“项目”选项卡 。Select Next : Artifacts at the bottom of the page or the Artifacts tab at the top of the page.

  5. 在资源组下添加角色分配:Add a role assignment under the resource group:

    1. 在“ResourceGroup”条目下选择“+ 添加项目”行 。Select the + Add artifact row directly under the ResourceGroup entry.

    2. 为“项目类型”选择“角色分配” 。Select Role assignment for Artifact type.

    3. 在“角色”下,选择“所有者”并清除“添加用户、应用或组”框下的复选框 。Under Role, select Owner, and clear the check box under the Add user, app or group box.

    4. 搜索并选择要添加的用户、应用或组。Search for and select a user, app, or group to add. 此项目使用每次分配此蓝图时以同样方式设置的静态参数。This artifact uses a static parameter set the same in every assignment of this blueprint.

    e.e. 选择“添加” 将此项目添加到蓝图中。Select Add to add this artifact to the blueprint.

    蓝图项目的第二个角色分配

  6. 已完成的蓝图应如下所示:Your completed blueprint should look similar to the following. 请注意,新添加的角色分配显示“已填充 1 个参数中的 1 个” 。Notice that the newly added role assignment shows 1 out of 1 parameters populated. 这意味着它是一个静态参数。That means it's a static parameter.

    已完成的蓝图的第二个定义

  7. 草稿更新后,请单击“保存草稿” 。Select Save Draft now that it has been updated.

发布蓝图Publish a blueprint

现在,所有计划项目都已添加到蓝图中,可以将其发布了。Now that all the planned artifacts have been added to the blueprint, it's time to publish it. 发布后,即可将蓝图分配到订阅。Publishing makes the blueprint available to be assigned to a subscription.

  1. 从左侧页面中选择“蓝图定义” 。Select Blueprint definitions from the page on the left.

  2. 在蓝图列表中,右键单击之前创建的蓝图,然后选择“发布蓝图” 。In the list of blueprints, right-click the one you previously created and select Publish blueprint.

  3. 在打开的窗格中,提供版本 (字母、数字和连字符,最大长度为 20 个字符),例如“v1” 。In the pane that opens, provide a Version (letters, numbers, and hyphens with a maximum length of 20 characters), such as v1. (可选)并提供更改注释,例如“首次发布” 。Optionally, enter text in Change notes, such as First publish.

  4. 选择页面底部的“发布”。 Select Publish at the bottom of the page.

分配蓝图Assign a blueprint

发布蓝图后,可将其分配到订阅。After a blueprint has been published, it can be assigned to a subscription. 将创建的蓝图分配到管理组层次结构下的一个订阅。Assign the blueprint that you created to one of the subscriptions under your management group hierarchy. 如果蓝图保存到某个订阅,则只能将其分配给该订阅。If the blueprint is saved to a subscription, it can only be assigned to that subscription.

  1. 从左侧页面中选择“蓝图定义” 。Select Blueprint definitions from the page on the left.

  2. 在蓝图列表中,右键单击之前创建的蓝图(或选择省略号),然后选择“分配蓝图” 。In the list of blueprints, right-click the one that you previously created (or select the ellipsis) and select Assign blueprint.

  3. 在“分配蓝图”页面上,从“订阅”下拉列表中选择要将此蓝图部署到的订阅 。On the Assign blueprint page, in the Subscription drop-down list, select the subscriptions that you want to deploy this blueprint to.

    如果 Azure 计费中提供了受支持的企业产品/服务,则会在“订阅”框下激活“新建”链接 。If there are supported Enterprise offerings available from Azure Billing, a Create new link is activated under the Subscription box. 执行以下步骤:Follow these steps:

    1. 选择“新建”链接以创建新订阅,而不是选择现有订阅 。Select the Create new link to create a new subscription instead of selecting existing ones.

    2. 提供新订阅的“显示名称” 。Provide a Display name for the new subscription.

    3. 从下拉列表中选择可用“产品/服务” 。Select the available Offer from the drop-down list.

    4. 使用省略号选择管理组,订阅将是其子级。Use the ellipsis to select the management group that the subscription will be a child of.

    5. 在页面底部选择“创建” 。Select Create at the bottom of the page.

    创建蓝图分配订阅的订阅

    重要

    选择“创建”后,将立即创建新订阅 。The new subscription is created immediately after you select Create.

    备注

    将为选择每个订阅创建一个分配。An assignment is created for each subscription that you select. 可以在以后对单个订阅分配进行更改,而不强制对所选订阅的其余部分进行更改。You can make changes to a single subscription assignment at a later time without forcing changes on the remainder of the selected subscriptions.

  4. 对于“分配名称”,请为此分配提供唯一名称 。For Assignment name, provide a unique name for this assignment.

  5. 在“位置” 中,选择要在其中创建托管标识和订阅部署对象的区域。In Location, select a region for the managed identity and subscription deployment object to be created in. Azure 蓝图使用此托管标识在分配的蓝图中部署所有项目。Azure Blueprint uses this managed identity to deploy all artifacts in the assigned blueprint. 若要了解详细信息,请参阅 Azure 资源的托管标识To learn more, see Managed identities for Azure resources.

  6. 在“v1” 条目上保留已发布 版本的“蓝图定义版本” 下拉列表。Leave the Blueprint definition version drop-down selection of Published versions on the v1 entry. (默认为最近的已发布版本。)(The default is the most recently published version.)

  7. 对于“锁定分配” ,保留默认值“不锁定” 。For Lock Assignment, leave the default of Don't Lock. 有关详细信息,请参阅蓝图资源锁定For more information, see Blueprints resource locking.

    分配的锁定和托管标识

  8. 托管标识下,保留默认值“系统已分配” 。Under Managed Identity, leave the default of System assigned.

  9. 对于订阅级别的角色分配“[用户组或应用程序名称]: 参与者”,搜索并选择用户、应用或组。For the subscription level role assignment [User group or application name] : Contributor, search for and select a user, app, or group.

  10. 对于订阅级别策略分配,请将“标记名称” 设置为“CostCenter”,并将“标记值” 设置为“ContosoIT” 。For the subscription level policy assignment, set Tag Name to CostCenter and the Tag Value to ContosoIT.

  11. 对于“ResourceGroup”,从下拉列表中提供“StorageAccount”的名称 和“East US 2”的位置 。For ResourceGroup, provide a Name of StorageAccount and a Location of East US 2 from the drop-down list.

    备注

    对于在蓝图定义期间在资源组下添加的每个项目,该项目将缩进以与将部署的资源组或对象对齐。For each artifact that you added under the resource group during blueprint definition, that artifact is indented to align with the resource group or object that you'll deploy it with. 只有在上下文信息中才会列出无法获取参数或者在分配时没有要定义的参数的项目。Artifacts that either don't take parameters or have no parameters to be defined at assignment are listed only for contextual information.

  12. 在 Azure 资源管理器模板“StorageAccount”上,为 storageAccountType 参数选择“Standard_GRS” 。On the Azure Resource Manager template StorageAccount, select Standard_GRS for the storageAccountType parameter.

  13. 阅读页面底部的信息框,然后选择“分配” 。Read the information box at the bottom of the page, and then select Assign.

跟踪蓝图的部署Track deployment of a blueprint

将蓝图分配给一个或多个订阅时,会发生以下两种情况:When a blueprint has been assigned to one or more subscriptions, two things happen:

  • 蓝图将添加到每个订阅的“分配的蓝图”页 The blueprint is added to the Assigned blueprints page for each subscription.
  • 开始部署蓝图定义的所有项目的过程。The process of deploying all the artifacts defined by the blueprint begins.

现在已将蓝图分配给订阅,请验证部署的进度:Now that the blueprint has been assigned to a subscription, verify the progress of the deployment:

  1. 从左侧页面选择“分配的蓝图” 。Select Assigned blueprints from the page on the left.

  2. 在蓝图列表中,右键单击之前分配的一个蓝图,然后选择“查看分配详细信息” 。In the list of blueprints, right-click the one that you previously assigned and select View assignment details.

    在“分配的蓝图”页中查看分配详细信息

  3. 在“蓝图分配”页面上,验证是否已成功部署所有项目,以及在部署期间是否未出现任何错误 。On the Blueprint assignment page, validate that all artifacts were successfully deployed and that there were no errors during the deployment. 如果发生错误,请参阅蓝图故障排除,了解确定错误原因的操作步骤。If errors occurred, see Troubleshooting blueprints for steps to determine what went wrong.

取消分配蓝图Unassign a blueprint

如果不再需要蓝图,请从订阅中删除蓝图分配。If you no longer need a blueprint assignment, remove it from a subscription. 蓝图可能已被替换为更新的蓝图,后者具有更新的模式、策略和设计。The blueprint might have been replaced by a newer blueprint with updated patterns, policies, and designs. 删除蓝图时,作为该蓝图的一部分分配的项目将保留。When a blueprint is removed, the artifacts assigned as part of that blueprint are left behind. 若要删除蓝图分配,请按照下列步骤操作:To remove a blueprint assignment, follow these steps:

  1. 从左侧页面选择“分配的蓝图” 。Select Assigned blueprints from the page on the left.

  2. 在蓝图列表中,选择要取消分配的蓝图。In the list of blueprints, select the blueprint that you want to unassign. 然后选择页面顶部的“取消分配蓝图”按钮。 Then select the Unassign blueprint button at the top of the page.

  3. 阅读确认消息,然后选择“确定” 。Read the confirmation message and then select OK.

删除蓝图Delete a blueprint

  1. 从左侧页面中选择“蓝图定义” 。Select Blueprint definitions from the page on the left.

  2. 右键单击要删除的蓝图,然后选择“删除蓝图” 。Right-click the blueprint that you want to delete, and select Delete blueprint. 在确认对话框中选择“是”。 Then select Yes in the confirmation dialog box.

备注

删除此方法中的蓝图还会删除所选蓝图的所有已发布版本。Deleting a blueprint in this method also deletes all published versions of the selected blueprint. 若要删除单个版本,请打开蓝图,选择“已发布版本” 选项卡,选择要删除的版本,然后选择“删除此版本” 。To delete a single version, open the blueprint, select the Published versions tab, select the version that you want to delete, and then select Delete This Version. 另外,只有在删除蓝图定义的所有蓝图分配之后,才能删除该蓝图。Also, you can't delete a blueprint until you've deleted all blueprint assignment of that blueprint definition.

后续步骤Next steps