AzPolicyAdvertizer

last sync: 2024-May-03 17:44:48 UTC

Subnets should have a Network Security Group

Azure Landing Zones (ALZ) Policy definition

Source Repository Azure Landing Zones (ALZ) GitHub
JSON Deny-Subnet-Without-Nsg
Display name Subnets should have a Network Security Group
Id Deny-Subnet-Without-Nsg
Version 2.0.0
Details on versioning
Category Network
Description This policy denies the creation of a subnet without a Network Security Group. NSG help to protect traffic across subnet-level.
Mode All
Type Custom Azure Landing Zones (ALZ)
Preview False
Deprecated False
Effect Default
Deny
Allowed
Audit, Deny, Disabled
RBAC role(s) none
Rule aliases IF (4)
Alias Namespace ResourceType DefaultPath Modifiable
Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id Microsoft.Network virtualNetworks/subnets properties.networkSecurityGroup.id true
Microsoft.Network/virtualNetworks/subnets[*] Microsoft.Network virtualNetworks properties.subnets[*] false
Microsoft.Network/virtualNetworks/subnets[*].name Microsoft.Network virtualNetworks properties.subnets[*].name false
Microsoft.Network/virtualNetworks/subnets[*].networkSecurityGroup.id Microsoft.Network virtualNetworks properties.subnets[*].properties.networkSecurityGroup.id true
Rule resource types IF (2)
Microsoft.Network/virtualNetworks
Microsoft.Network/virtualNetworks/subnets
Initiatives usage none
History none
JSON compare n/a
JSON
EPAC