-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathdine_NSG_inbound_block_1433_with_nsg_priority_rule.json
114 lines (114 loc) · 5.25 KB
/
dine_NSG_inbound_block_1433_with_nsg_priority_rule.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
{
"properties": {
"mode": "All",
"displayName": "Deny 5432 Postgress open to the internet.",
"description": "Deny 5432 Postgress open to the internet.",
"metadata": {
"category": "InfoSec Compliance"
},
"parameters": {
"blockedPort": {
"type": "string",
"metadata": {
"displayName": "DeployifNotExist Block Inbound Internet Port 1433 with rule priority 112"
}
},
"securityRulePriority": {
"type": "string",
"defaultValue": "112",
"metadata": {
"displayName": "Security Rule Priority"
}
}
},
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.Network/networkSecurityGroups"
},
"then": {
"effect": "deployIfNotExists",
"details": {
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"existenceCondition": {
"allOf": [{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
"equals": "Deny"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
"equals": "Inbound"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/priority",
"equals": "[parameters('securityRulePriority')]"
},
{
"anyOf": [{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
"equals": "[parameters('blockedPort')]"
},
{
"not": {
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
"notEquals": "[parameters('blockedPort')]"
}
}
]
}
]
},
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
],
"deployment": {
"properties": {
"mode": "incremental",
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"nsgName": {
"type": "string"
},
"priority": {
"type": "string"
},
"port": {
"type": "string"
}
},
"resources": [{
"name": "[concat(parameters('nsgName'),'/denyMSSQLInternet')]",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"apiVersion": "2018-03-01",
"properties": {
"protocol": "*",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"sourcePortRange": "*",
"destinationPortRange": "[parameters('port')]",
"access": "Deny",
"direction": "Inbound",
"priority": "[int(parameters('priority'))]"
}
}]
},
"parameters": {
"nsgName": {
"value": "[field('name')]"
},
"priority": {
"value": "[parameters('securityRulePriority')]"
},
"port": {
"value": "[parameters('blockedPort')]"
}
}
}
}
}
}
}
}
}