jsonazurepolicynicazure-nsg

Azure Policy to deny creation of Network Interfaces without NSG attached


Hey I am looking to assign Azure Policy which will deny creation of Network Interfaces without NSG attached.

I looked with build-in role and couldn't find anything related. Maybe someone have script that does the job.

Thanks for your help in advance.


Solution

  • I tried to create the azure policy to deny creation of network interface without NSG

    I have created the policy definition named network

    enter image description here

    In the policy rule write the below json script to create the policy rules to deny the virtual network without NSG rules I took the example reference from git URL @withstu

     {
          "name": "Deny-Subnet-Without-Nsg",
          "type": "Microsoft.Authorization/policyDefinitions",
          "apiVersion": "2022-11-22",
          "scope": null,
          "properties": {
            "policyType": "Custom",
            "mode": "All",
            "displayName": "Subnets should have a Network Security Group",
            "description": " policy will deny the creation of a network/subnet with out an NSG.",
            "metadata": {
              "version": "1.1.0",
              "category": "Network"
            },
            "parameters": {
              "effect": {
                "type": "String",
                "allowedValues": [
                  "Audit",
                  "Deny",
                  "Disabled"
                ],
                "defaultValue": "Deny",
                "metadata": {
                  "displayName": "Effect",
                  "description": " disable the execution of the policy"
                }
              },
              "excludedSubnets": {
                "type": "Array",
                "metadata": {
                  "displayName": "Excluded Subnets",
                  "description": "subnets excluded from this policy"
                },
                "defaultValue": [
                  "GatewaySubnet",
                  "AzureFirewallSubnet",
                  "AzureFirewallManagementSubnet"
                ]
              }
            },
            "policyRule": {
              "if": {
                "anyOf": [
                  {
                    "allOf": [
                      {
                        "equals": "Microsoft.Network/virtualNetworks",
                        "field": "type"
                      },
                      {
                        "exists": "false",
                        "field": "Microsoft.Network/virtualNetworks/subnets[*].networkSecurityGroup.id"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "equals": "Microsoft.Network/virtualNetworks/subnets",
                        "field": "type"
                      },
                      {
                        "field": "name",
                        "notIn": "[parameters('excludedSubnets')]"
                      },
                      {
                        "exists": "false",
                        "field": "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id"
                      }
                    ]
                  }
                ]
              },
              "then": {
                "effect": "[parameters('effect')]"
              }
            }
          }
        }
    

    I have assigned the policy to the policy definition

    In left side of the menu click on Assignment => click on assign policy and added the appropriate fields to create

    enter image description here

    After assigning the polices it will take 30 minutes to reflect

    I am trying to creating the virtual network , I got the error because of deny subnet without NSG

    enter image description here