AzPolicyAdvertizer

last sync: 2025-May-21 17:57:15 UTC

Deny NSG rule inbound from internet - Network Security Group

Community Policy definition

Source Repository Community-Policy GitHub
JSON Community-Policy GitHub
Deploy policy 125e78be-b7cd-4fa9-a269-729e6ef27d49 (1.0.0) to Azure
Display name Deny NSG rule inbound from internet - Network Security Group
Id 125e78be-b7cd-4fa9-a269-729e6ef27d49
Version 1.0.0
Details on versioning
Category Network
Microsoft Learn
Description This Policy will detect if an NSG rule would allow a port or set of ports to be accessed from outside of an IP whitelist. This will check Service Tags as well as Port Ranges. Example, if you specify port 22 in the parameter for this Policy, and only allow communications from 10.0.0.0/8, and someone creates a rule that allows ports 20-30 inbound from 20.x.x.x, this would be denied as 22 falls within that port range and 20.x.x.x is not on the IP whitelist. This Policy is part of a set of policies. Both must b
Mode All
Type Custom Community
Effect Default
Audit
Allowed
Deny, Audit, Disabled
RBAC role(s) none
Rule aliases IF (7)
Alias Namespace ResourceType Path PathIsDefault DefaultPath Modifiable
Microsoft.Network/networkSecurityGroups/securityRules[*] Microsoft.Network networkSecurityGroups properties.securityRules[*] True True
Microsoft.Network/networkSecurityGroups/securityRules[*].access Microsoft.Network networkSecurityGroups properties.securityRules[*].properties.access True True
Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange Microsoft.Network networkSecurityGroups properties.securityRules[*].properties.destinationPortRange True True
Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRanges[*] Microsoft.Network networkSecurityGroups properties.securityRules[*].properties.destinationPortRanges[*] True True
Microsoft.Network/networkSecurityGroups/securityRules[*].direction Microsoft.Network networkSecurityGroups properties.securityRules[*].properties.direction True True
Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix Microsoft.Network networkSecurityGroups properties.securityRules[*].properties.sourceAddressPrefix True True
Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefixes[*] Microsoft.Network networkSecurityGroups properties.securityRules[*].properties.sourceAddressPrefixes[*] True True
Rule resource types IF (1)
Microsoft.Network/networkSecurityGroups
JSON
EPAC
Deploy policy 125e78be-b7cd-4fa9-a269-729e6ef27d49 (1.0.0) to Azure