I'm trying to create an azure policy that audits my NSGs.
I need to verify if my NSGs contain a rule where the source and destination match and are both IP addresses (so not "Virtual Machine")
I currently have the following:
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/networkSecurityGroups"
},
{
"count": {
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
"where": {
"allOf": [
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourcePortRange",
"equals": "*"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange",
"equals": "*"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix",
"match": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationAddressPrefix"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationAddressPrefix",
"match": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access",
"equals": "Allow"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction",
"equals": "Inbound"
}
]
}
},
"notEquals": 1
}
]
},
"then": {
"effect": "audit"
}
},
"parameters": {}
}
However this says that all my NSGs are non compliant, even though I know some of them are.
Is this possible?
Thanks in advance