Azure Resource Manager 概觀Azure Resource Manager overview

Azure Resource Manager 是 Azure 的部署和管理服務。Azure Resource Manager is the deployment and management service for Azure. 其提供一致的管理層,可讓您建立、更新和刪除您 Azure 訂用帳戶中的資源。It provides a consistent management layer that enables you to create, update, and delete resources in your Azure subscription. 您可以使用其存取控制、稽核和標記功能,在部署後保護及組織您的資源。You can use its access control, auditing, and tagging features to secure and organize your resources after deployment.

當您透過入口網站、PowerShell、Azure CLI、REST API 或用戶端 SDK 採取動作時,Azure Resource Manager API 會處理您的要求。When you take actions through the portal, PowerShell, Azure CLI, REST APIs, or client SDKs, the Azure Resource Manager API handles your request. 因為所有要求都是透過相同的 API 來處理,所以您會在所有不同工具中看到一致的結果和功能。Because all requests are handled through the same API, you see consistent results and capabilities in all the different tools. 透過 PowerShell、Azure CLI、REST API 和用戶端 SDK 也可以使用入口網站中的所有可用功能。All capabilities that are available in the portal are also available through PowerShell, Azure CLI, REST APIs, and client SDKs. 一開始透過 API 發行的功能將會在初次發行的 180 天內呈現在入口網站中。Functionality initially released through APIs will be represented in the portal within 180 days of initial release.

下圖顯示這些工具如何與 Azure Resource Manager API 互動。The following image shows how all the tools interact with the Azure Resource Manager API. API 將要求傳遞給 Resource Manager 服務,由其驗證和授權要求。The API passes requests to the Resource Manager service, which authenticates and authorizes the requests. 然後,Resource Manager 將要求路由傳送到適當的服務。Resource Manager then routes the requests to the appropriate service.

Resource Manager 要求模型

術語Terminology

如果您不熟悉 Azure Resource Manager,則您可能不熟悉一些詞彙。If you're new to Azure Resource Manager, there are some terms you might not be familiar with.

  • 資源 - 透過 Azure 提供的可管理項目。resource - A manageable item that is available through Azure. 虛擬機器、儲存體帳戶、Web 應用程式、資料庫和虛擬網路都是資源範例。Virtual machines, storage accounts, web apps, databases, and virtual networks are examples of resources.
  • 資源群組 - 保留 Azure 方案相關資源的容器。resource group - A container that holds related resources for an Azure solution. 資源群組包含您要以群組的形式管理的資源。The resource group includes those resources that you want to manage as a group. 您可決定如何根據對組織最有利的方式,將資源配置到資源群組。You decide how to allocate resources to resource groups based on what makes the most sense for your organization. 請參閱 資源群組See Resource groups.
  • 資源提供者 - 提供 Azure 資源的服務。resource provider - A service that supplies Azure resources. 例如,Microsoft.Compute 是常見的資源提供者,可提供虛擬機器資源。For example, a common resource provider is Microsoft.Compute, which supplies the virtual machine resource. Microsoft.Storage 是另一個常見的資源提供者。Microsoft.Storage is another common resource provider. 請參閱 資源提供者See Resource providers.
  • Resource Manager 範本 - JavaScript 物件標記法 (JSON) 檔案,可定義一或多個要部署至資源群組或訂用帳戶的資源。Resource Manager template - A JavaScript Object Notation (JSON) file that defines one or more resources to deploy to a resource group or subscription. 範本可用來以一致性方式重複部署資源。The template can be used to deploy the resources consistently and repeatedly. 請參閱 範本部署See Template deployment.
  • 宣告式語法 - 可讓您陳述「以下是我想要建立的項目」而不需要撰寫一連串程式設計命令來加以建立的語法。declarative syntax - Syntax that lets you state "Here is what I intend to create" without having to write the sequence of programming commands to create it. Resource Manager 範本便是宣告式語法的其中一個範例。The Resource Manager template is an example of declarative syntax. 在該檔案中,您可以定義要部署至 Azure 之基礎結構的屬性。In the file, you define the properties for the infrastructure to deploy to Azure.

使用 Resource Manager 的優點The benefits of using Resource Manager

Resource Manager 會提供數個優點:Resource Manager provides several benefits:

  • 您可以以群組形式部署、管理及監視方案的所有資源,而不是個別處理這些資源。You can deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually.
  • 您可以在整個方案週期重複部署方案,並確信您的資源會部署在一致的狀態中。You can repeatedly deploy your solution throughout the development lifecycle and have confidence your resources are deployed in a consistent state.
  • 您可以透過宣告式範本而非指令碼來管理基礎結構。You can manage your infrastructure through declarative templates rather than scripts.
  • 您可以定義之間的相依性,使得以正確的順序部署資源。You can define the dependencies between resources so they're deployed in the correct order.
  • 因為角色型存取控制 (RBAC) 會原生整合至管理平台,您可以將存取控制套用至資源群組中的所有服務。You can apply access control to all services in your resource group because Role-Based Access Control (RBAC) is natively integrated into the management platform.
  • 您可以將標籤套用至資源,以便以邏輯方式組織訂用帳戶中的所有資源。You can apply tags to resources to logically organize all the resources in your subscription.
  • 您可以檢視共用相同標籤之資源群組的成本,以釐清您的組織的計費方式。You can clarify your organization's billing by viewing costs for a group of resources sharing the same tag.

了解管理範圍Understand management scope

Azure 提供四個管理範圍層級:管理群組、訂用帳戶、資源群組和資源。Azure provides four levels of management scope: management groups, subscriptions, resource groups, and resources. 下圖顯示這些層級的範例。The following image shows an example of these layers.

影響範圍

您可以在任何範圍層級套用管理設定。You apply management settings at any of these levels of scope. 您選取的層級會決定套用設定的範圍。The level you select determines how widely the setting is applied. 較低層級會從較高層級繼承設定。Lower levels inherit settings from higher levels. 例如,當您將原則套用到訂用帳戶時,訂用帳戶中的所有資源群組和資源都會套用該原則。For example, when you apply a policy to the subscription, the policy is applied to all resource groups and resources in your subscription. 當您在資源群組上套用原則時,資源群組及其所有資源都會套用該原則。When you apply a policy on the resource group, that policy is applied the resource group and all its resources. 不過,另一個資源群組沒有該原則指派。However, another resource group does not have that policy assignment.

指引Guidance

下列建議可協助您在使用您的方案時充分利用 Resource Manager。The following suggestions help you take full advantage of Resource Manager when working with your solutions.

  • 透過 Resource Manager 範本中的宣告式語法定義和部署基礎結構,而非透過命令式指令。Define and deploy your infrastructure through the declarative syntax in Resource Manager templates, rather than through imperative commands.
  • 在範本中定義所有的部署和設定步驟。Define all deployment and configuration steps in the template. 您在設定方案時應該沒有手動步驟。You should have no manual steps for setting up your solution.
  • 執行命令式指令來管理您的資源,例如啟動或停止應用程式或機器。Run imperative commands to manage your resources, such as to start or stop an app or machine.
  • 利用與資源群組中相同的生命週期排列資源。Arrange resources with the same lifecycle in a resource group. 將標記用於資源的所有其他組織方式。Use tags for all other organizing of resources.

如需關於企業如何使用 Resource Manager 有效地管理訂用帳戶的指引,請參閱 Azure 企業 Scaffold - 規定的訂用帳戶治理For guidance on how enterprises can use Resource Manager to effectively manage subscriptions, see Azure enterprise scaffold - prescriptive subscription governance.

如需建立 Resource Manager 範本的建議,請參閱 Azure Resource Manager 範本最佳做法For recommendations on creating Resource Manager templates, see Azure Resource Manager template best practices.

資源群組Resource groups

定義資源群組時,必須考慮一些重要因素:There are some important factors to consider when defining your resource group:

  • 群組中的所有資源應該共用相同的生命週期。All the resources in your group should share the same lifecycle. 您可一起部署、更新和刪除它們。You deploy, update, and delete them together. 如果類似資料庫伺服器這樣的資源必須存在於不同的部署週期,它應該位於另一個資源群組中。If one resource, such as a database server, needs to exist on a different deployment cycle it should be in another resource group.
  • 每個資源只能存在於一個資源群組中。Each resource can only exist in one resource group.
  • 您可以隨時在資源群組中新增或移除資源。You can add or remove a resource to a resource group at any time.
  • 您可以將資源從一個資源群組移動到另一個群組。You can move a resource from one resource group to another group. 如需詳細資訊,請參閱 將資源移動到新的資源群組或訂用帳戶For more information, see Move resources to new resource group or subscription.
  • 資源群組可以包含位於不同區域的資源。A resource group can contain resources that are located in different regions.
  • 資源群組可以用來設定系統管理動作的存取控制範圍。A resource group can be used to scope access control for administrative actions.
  • 資源可與其他資源群組中的資源互動。A resource can interact with resources in other resource groups. 此互動常見於兩個資源彼此連結,但未共用相同的生命週期 (例如,連接至某個資料庫的 Web 應用程式) 時。This interaction is common when the two resources are related but don't share the same lifecycle (for example, web apps connecting to a database).

建立資源群組時,您需要提供該資源群組的位置。When creating a resource group, you need to provide a location for that resource group. 您可能會想:「為什麼資源群組需要位置?You may be wondering, "Why does a resource group need a location? 而且,如果資源可以有不同於資源群組的位置,為什麼資源群組位置這麼重要?」And, if the resources can have different locations than the resource group, why does the resource group location matter at all?" 資源群組會儲存資源相關中繼資料。The resource group stores metadata about the resources. 因此,當您指定資源群組的位置時,您便是指定中繼資料的儲存位置。Therefore, when you specify a location for the resource group, you're specifying where that metadata is stored. 基於相容性理由,您可能需要確保您的資料存放在特定區域中。For compliance reasons, you may need to ensure that your data is stored in a particular region.

如果資源群組的區域暫時無法使用,您就無法更新資源群組中的資源,因為中繼資料無法使用。If the resource group's region is temporarily unavailable, you can't update resources in the resource group because the metadata is unavailable. 其他區域中的資源仍可如預期般運作,但您無法更新這些資源。The resources in other regions will still function as expected, but you can't update them. 若要將風險降至最低,請將資源群組和資源放在相同區域。To minimize risk, locate your resource group and resources in the same region.

資源提供者Resource providers

每個資源提供者都會提供一組資源和作業,以便能運用這些資源。Each resource provider offers a set of resources and operations for working with those resources. 例如,如果想要儲存金鑰和密碼,您會使用 Microsoft.KeyVault 資源提供者。For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. 此資源提供者會提供稱為保存庫的資源類型來建立金鑰保存庫。This resource provider offers a resource type called vaults for creating the key vault.

資源類型名稱的格式:{resource-provider}/{resource-type}The name of a resource type is in the format: {resource-provider}/{resource-type}. 金鑰保存庫的資源類型是 Microsoft.KeyVault/vaultsThe resource type for a key vault is Microsoft.KeyVault/vaults.

在開始部署資源之前,您應該先了解可用的資源提供者。Before getting started with deploying your resources, you should gain an understanding of the available resource providers. 了解資源提供者和資源的名稱可協助您定義想要部署至 Azure 的資源。Knowing the names of resource providers and resources helps you define resources you want to deploy to Azure. 此外,您需要知道有效的位置,以及每個資源類型的 API 版本。Also, you need to know the valid locations and API versions for each resource type. 如需詳細資訊,請參閱資源提供者和類型For more information, see Resource providers and types.

針對資源提供者提供的所有作業,請參閱 Azure REST APIFor all the operations offered by resource providers, see the Azure REST APIs.

範本部署Template deployment

利用 Resource Manager,您可以建立可定義 Azure 方案之基礎結構和組態的範本 (以 JSON 格式)。With Resource Manager, you can create a template (in JSON format) that defines the infrastructure and configuration of your Azure solution. 透過範本,您可以在整個生命週期中重複部署方案,並確信您的資源會以一致的狀態部署。By using a template, you can repeatedly deploy your solution throughout its lifecycle and have confidence your resources are deployed in a consistent state.

若要了解範本格式和其建構方式,請參閱了解 Azure Resource Manager 範本的結構和語法To learn about the format of the template and how you construct it, see Understand the structure and syntax of Azure Resource Manager Templates. 若要檢視資源類型的 JSON 語法,請參閱在 Azure Resource Manager 範本中定義資源To view the JSON syntax for resources types, see Define resources in Azure Resource Manager templates.

Resource Manager 處理範本的方式會和處理其他任何要求一樣。Resource Manager processes the template like any other request. 它會剖析範本,並將其語法轉換成適當的資源提供者所需的 REST API 作業。It parses the template and converts its syntax into REST API operations for the appropriate resource providers. 例如,當 Resource Manager 收到具有下列資源定義的範本︰For example, when Resource Manager receives a template with the following resource definition:

"resources": [
  {
    "apiVersion": "2016-01-01",
    "type": "Microsoft.Storage/storageAccounts",
    "name": "mystorageaccount",
    "location": "westus",
    "sku": {
      "name": "Standard_LRS"
    },
    "kind": "Storage",
    "properties": {
    }
  }
]

它會將定義轉換成下列 REST API 作業,該作業會再傳送給 Microsoft.Storage 資源提供者︰It converts the definition to the following REST API operation, which is sent to the Microsoft.Storage resource provider:

PUT
https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/mystorageaccount?api-version=2016-01-01
REQUEST BODY
{
  "location": "westus",
  "properties": {
  }
  "sku": {
    "name": "Standard_LRS"
  },
  "kind": "Storage"
}

範本和資源群組的定義方式全由您決定,方案的管理方式也是如此。How you define templates and resource groups is entirely up to you and how you want to manage your solution. 比方說,您可以透過單一範本在單一資源群組中部署三層式應用程式。For example, you can deploy your three tier application through a single template to a single resource group.

三層式範本

但您不需要在單一的範本中定義整個基礎結構。But, you don't have to define your entire infrastructure in a single template. 通常的合理作法是將您的部署需求分成一組有目標及特定目的的範本。Often, it makes sense to divide your deployment requirements into a set of targeted, purpose-specific templates. 您可以輕鬆地將這些份本重複使用於不同的方案。You can easily reuse these templates for different solutions. 若要部署特定的方案,您會建立連結所有必要範本的主版範本。To deploy a particular solution, you create a master template that links all the required templates. 下圖顯示如何透過包含三個巢狀範本的父範本部署三層式方案。The following image shows how to deploy a three tier solution through a parent template that includes three nested templates.

巢狀階層範本

如果您想像的階層有不同的生命週期,您可以將這三個階層部署到不同的資源群組。If you envision your tiers having separate lifecycles, you can deploy your three tiers to separate resource groups. 請注意,資源仍可連結至其他資源群組中的資源。Notice the resources can still be linked to resources in other resource groups.

階層範本

如需巢狀範本的相關資訊,請參閱透過 Azure Resource Manager 使用連結的範本For information about nested templates, see Using linked templates with Azure Resource Manager.

Azure Resource Manager 會分析相依性,確保以正確的順序建立資源。Azure Resource Manager analyzes dependencies to ensure resources are created in the correct order. 如果某個資源依賴另一個資源的值 (例如需要儲存體帳戶以供磁碟使用的虛擬機器),您必須設定相依性。If one resource relies on a value from another resource (such as a virtual machine needing a storage account for disks), you set a dependency. 如需詳細資訊,請參閱 定義 Azure Resource Manager 範本中的相依性For more information, see Defining dependencies in Azure Resource Manager templates.

您也可以使用範本進行基礎結構的更新。You can also use the template for updates to the infrastructure. 例如,您可以將資源新增至您的方案,並將組態規則新增至已部署的資源。For example, you can add a resource to your solution and add configuration rules for the resources that are already deployed. 如果此範本定義的資源已經存在,則 Resource Manager 會更新現有資源,而不是建立新資產。If the template defines a resource that already exists, Resource Manager updates the existing resource instead of creating a new one.

當您需要其他作業 (例如安裝不包含在安裝程式的特定軟體) 時,Resource Manager 會提供案例的延伸模組。Resource Manager provides extensions for scenarios when you need additional operations such as installing particular software that isn't included in the setup. 如果您已經使用組態管理服務,例如 DSC、Chef 或 Puppet,您可以透過使用擴充功能繼續使用該服務。If you're already using a configuration management service, like DSC, Chef or Puppet, you can continue working with that service by using extensions. 如需虛擬機器擴充功能的相關資訊,請參閱有關虛擬機器擴充功能和功能For information about virtual machine extensions, see About virtual machine extensions and features.

當您從入口網站建立方案,方案會自動包含部署範本。When you create a solution from the portal, the solution automatically includes a deployment template. 您不必從頭建立您的範本,因為您可以從方案的範本開始,並自訂範本以符合您的特定需求。You don't have to create your template from scratch because you can start with the template for your solution and customize it to meet your specific needs. 如需範例,請參閱快速入門:使用 Azure 入口網站建立及部署 Azure Resource Manager 範本For a sample, see Quickstart: Create and deploy Azure Resource Manager templates by using the Azure portal. 亦可匯出資源群組的目前狀態,或檢視特定部署所用的範本,以擷取現有資源群組的範本。You can also retrieve a template for an existing resource group by either exporting the current state of the resource group, or viewing the template used for a particular deployment. 檢視匯出的範本有助於了解範本語法。Viewing the exported template is a helpful way to learn about the template syntax.

最後,範本會成為應用程式原始碼的一部分。Finally, the template becomes part of the source code for your app. 您可以檢查您的原始程式碼存放庫,並隨著您的應用程式發展加以更新。You can check it in to your source code repository and update it as your app evolves. 您可以透過 Visual Studio 編輯範本。You can edit the template through Visual Studio.

在定義範本之後,您就可以開始將資源部署至 Azure。After defining your template, you're ready to deploy the resources to Azure. 若要部署資源,請參閱:To deploy the resources, see:

安全部署實務Safe deployment practices

當您在將複雜的服務部署到 Azure 時,您可能需要將服務部署到多個區域,並且在進行下一步之前,先檢查其健康情況。When deploying a complex service to Azure, you might need to deploy your service to multiple regions, and check its health before proceeding to the next step. 使用 Azure 部署管理員來協調服務的分段推出。Use Azure Deployment Manager to coordinate a staged rollout of the service. 透過將服務分段推出,您可以在服務部署到所有區域之前,先找出潛在的問題。By staging the rollout of your service, you can find potential problems before it has been deployed to all regions. 如果您不需要這些預防措施,則上一節中的部署作業會是比較好的選項。If you don't need these precautions, the deployment operations in the preceding section are the better option.

Deployment Manager 目前為個人預覽版。Deployment Manager is currently in private preview.

快速入門與教學課程Quickstarts and tutorials

使用下列快速入門和教學課程來了解如何開發資源管理員範本:Use the following quickstarts and tutorials to learn how to develop resource manager templates:

  • 快速入門Quickstarts

    標題Title 說明Description
    使用 Azure 入口網站Use the Azure portal 使用入口網站來產生範本,並了解編輯和部署範本的程序。Generate a template using the portal, and understand the process of editing and deploying the template.
    使用 Visual Studio CodeUse Visual Studio Code 使用 Visual Studio Code 來建立和編輯範本,以及如何使用 Azure Cloud shell 來部署範本。Use Visual Studio Code to create and edit templates, and how to use the Azure Cloud shell to deploy templates.
    使用 Visual StudioUse Visual Studio 使用 Visual Studio 來建立、編輯和部署範本。Use Visual Studio to create, edit, and deploy templates.
  • 教學課程Tutorials

    標題Title 說明Description
    利用範本參考Utilize template reference 利用範本參考文件來開發範本。Utilize the template reference documentation to develop templates. 在本教學課程中,您會找到儲存體帳戶結構描述,並使用該資訊來建立已加密的儲存體帳戶。In the tutorial, you find the storage account schema, and use the information to create an encrypted storage account.
    建立多個執行個體Create multiple instances 建立多個 Azure 資源執行個體。Create multiple instances of Azure resources. 在本教學課程中,您會建立多個儲存體帳戶執行個體。In the tutorial, you create multiple instances of storage account.
    設定資源部署順序Set resource deployment order 定義資源相依性。Define resource dependencies. 在本教學課程中,您會建立虛擬網路、虛擬機器及相依的 Azure 資源。In the tutorial, you create a virtual network, a virtual machine, and the dependent Azure resources. 您會了解如何定義相依性。You learn how the dependencies are defined.
    使用條件Use conditions 根據一些參數值來部署資源。Deploy resources based on some parameter values. 在本教學課程中,您會定義範本,以根據參數值建立新的儲存體帳戶或使用現有的儲存體帳戶。In the tutorial, you define a template to create a new storage account or use an existing storage account based on the value of a parameter.
    整合金鑰保存庫Integrate key vault 從 Azure Key Vault 擷取祕密/密碼。Retrieve secrets/passwords from Azure Key Vault. 在本教學課程中,您會建立虛擬機器。In the tutorial, you create a virtual machine. 虛擬機器系統管理員密碼會擷取自 Key Vault。The virtual machine administrator password is retrieved from a Key Vault.
    建立連結的範本Create linked templates 將範本模組化,並從某個範本呼叫其他範本。Modularize templates, and call other templates from a template. 在本教學課程中,您會建立虛擬網路、虛擬機器及相依的資源。In the tutorial, you create a virtual network, a virtual machine, and the dependent resources. 連結的範本中會定義相依儲存體帳戶。The dependent storage account is defined in a linked template.
    部署虛擬機器延伸模組Deploy virtual machine extensions 使用延伸模組來執行部署後工作。Perform post-deployment tasks by using extensions. 在本教學課程中,您會部署自訂指令碼延伸模組,以在虛擬機器上安裝 Web 伺服器。In the tutorial, you deploy a customer script extension to install web server on the virtual machine.
    部署 SQL 延伸模組Deploy SQL extensions 使用延伸模組來執行部署後工作。Perform post-deployment tasks by using extensions. 在本教學課程中,您會部署自訂指令碼延伸模組,以在虛擬機器上安裝 Web 伺服器。In the tutorial, you deploy a customer script extension to install web server on the virtual machine.
    保護成品Secure artifacts 保護完成部署所需的成品。Secure the artifacts needed to complete the deployments. 在教學課程中,您將了解如何保護 Deploy SQL 擴充功能教學課程中使用的成品。In the tutorial, you learn how to secure the artifact used in the Deploy SQL extensions tutorial.
    使用安全部署做法Use safe deployment practices 使用 Azure 部署管理員。Use Azure Deployment manager.
    教學課程:對 Resource Manager 範本部署進行疑難排解Tutorial: Troubleshoot Resource Manager template deployments 針對範本部署問題進行疑難排解。Troubleshoot template deployment issues.

您可以個別使用這些教學課程,或是當作一個用以學習主要 Resource Manager 範本開發概念的系列。These tutorials can be used individually, or as a series to learn the major Resource Manager template development concepts.

後續步驟Next steps

在本文中,您已了解如何使用 Azure Resource Manager 在 Azure 上進行資源的部署、管理及存取控制。In this article, you learned how to use Azure Resource Manager for deployment, management, and access control of resources on Azure. 請繼續前往下一篇文章,以了解如何建立第一個 Azure Resource Manager 範本。Proceed to the next article to learn how to create your first Azure Resource Manager template.