I want to be able to create a policy within Azure that prevents users from creating inbound NSG allow rules for ports 3389/22 from any/ internet source, either manually or via the options within the JIT-access menu.
I’ve tried creating a policy definition for this as per the below, but when testing it doesn’t apply to the resources within its scope, it still lets me create any rule I like.
{
"properties": {
"displayName": "Prevent creating RDP/SSH rule that allows any/ internet-based connections inbound to a VM",
"policyType": "Custom",
"mode": "Indexed",
"metadata": {
"version": "1.0.0",
"category": "Virtual Machine NSG Restriction",
"createdBy": "a8321135-8365-4f57-863c-4ab27962ff0c",
"createdOn": "2024-08-08T07:58:37.3955217Z",
"updatedBy": "a8321135-8365-4f57-863c-4ab27962ff0c",
"updatedOn": "2024-08-08T09:26:10.0736027Z"
},
"version": "1.0.0",
"parameters": {},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/networkSecurityGroups/securityRules"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
"equals": "Inbound"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
"equals": "Allow"
},
{
"anyOf": [
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
"equals": "*"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
"equals": "0.0.0.0/0"
}
]
},
{
"anyOf": [
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
"equals": "3389"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
"equals": "22"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
"equals": "*"
}
]
}
]
},
"then": {
"effect": "deny"
}
},
"versions": [
"1.0.0"
]
},
"id": "/subscriptions/[mysubscriptionID]/providers/Microsoft.Authorization/policyDefinitions/ab8771fb-c58c-42f3-b935-d8492919d5f7",
"type": "Microsoft.Authorization/policyDefinitions",
"name": "ab8771fb-c58c-42f3-b935-d8492919d5f7",
"systemData": {
"createdBy": "[myusername]",
"createdByType": "User",
"createdAt": "2024-08-08T07:58:37.3659311Z",
"lastModifiedBy": "[myusername]",
"lastModifiedByType": "User",
"lastModifiedAt": "2024-08-08T09:26:10.0603055Z"
}
}Can anyone advise how to set this up properly? Or if there is an easier way of achieving the same result?