Azure Policy Support for Port Ranges

Question

Problem - so I want to block people creating NSGs that open up Internet access to some ports (22, 3389, etc.). I can create a policy to block the specific port, e.g.,

{
"allOf": [{
        "field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
        "equals": "Allow"
    },
    {
        "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
        "equals": "Inbound"
    },
    {
        "anyOf": [{
                "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                "equals": "22"
            },
            {
                "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                "equals": "3389"
            }
        ]
    }
]

This will block creation of NSGs if the specific port is used in the security rules. But it can be bypassed if someone create a NSG rules that allows port ranges (such as 3300-3400).

Wondering how policy deals with port ranges and what the best way is in this case.

I tried destinationPortRanges[*] array but it does not work.

{
"not": {
    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
    "Equals": "22"
}

}

the rule still allows creation of NSGs when destinationPortRanges is specified as "20-25".

Answer 1

Look at the built-in policy "RDP access from the Internet should be blocked". There is also SSH access from the Internet should be blocked.

To be honest it is quite painful to read, but it looks like it covers exactly what you need.

{
                "anyOf": [
                  {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                    "equals": "*"
                  },
                  {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                    "equals": "3389"
                  },
                  {
                    "value": "[if(and(not(empty(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'))), contains(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'),'-')), and(lessOrEquals(int(first(split(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'), '-'))),3389),greaterOrEquals(int(last(split(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'), '-'))),3389)), 'false')]",
                    "equals": "true"
                  },
                  {
                      "count": {
                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                        "where": {
                          "value": "[if(and(not(empty(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')))), contains(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')),'-')), and(lessOrEquals(int(first(split(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')), '-'))),3389),greaterOrEquals(int(last(split(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')), '-'))),3389)) , 'false')]",
                          "equals": "true"
                        }
                      },
                      "greater": 0
                  },
                  {
                    "not": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                      "notEquals": "*"
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                      "notEquals": "3389"
                    }
                  }
                ]
              },