Remediation for Network restriction policy of Azure Storage account

Question

I have this definition file for "Storage accounts should restrict network access". I want to run this policy on existing storage account and if it does not meet it then change the network access(remove public access + assign a subset). How can I create this remediation as part of this policy?

"properties": {
    "displayName": "Audit Storage Accounts Open to Public Networks",
    "policyType": "Custom",
    "mode": "Indexed",
    "description": "This policy ensures that storage accounts with exposure to Public Networks are audited.",
    "parameters": {},
    "policyRule": {
        "if": {
            "allOf": [{
                    "field": "type",
                    "equals": "Microsoft.Storage/storageAccounts"
                },
                {
                    "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
                    "equals": "Allow"
                }
            ]
        },
        "then": {
            "effect": "audit"
        }
    }
}

Answer 1

If you want to assign VNET to the storage account with Azure Policy, you can use effect DeployIfNotExist to implement it. For example

My definition file. Please note that in the sample, you use an existing Subnet. If you want to create a new subnet, please refer to the template

{
  "properties": {
    "displayName": "storage3",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "DeployIfNotExists",
          "Disabled"
        ],
        "defaultValue": "DeployIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
            "notEquals": "Deny"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Storage/storageAccounts",
          "name": "[field('name')]",
          "existenceCondition": {
            "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
            "equals": "Deny"
          },
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"

          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "name": {
                    "type": "string"
                  },
                  "sku": {
                    "type": "string"
                  },
                  "location": {
                    "type": "string"
                  },
                  "kind": {
                    "type": "string"
                  }
                },
                "resources": [
                  {
                    "name": "[parameters('name')]",
                    "type": "Microsoft.Storage/storageAccounts",
                    "apiVersion": "2019-06-01",
                    "location": "[parameters('location')]",
                    "properties": {
                      "networkAcls": {
                        "bypass": "AzureServices",
                        "virtualNetworkRules": [
                          {
                            "id": "",
                            "action": "Allow"
                          }
                        ],
                        "ipRules": [],
                        "defaultAction": "Deny"
                      }
                    },
                    "dependsOn": [],
                    "sku": {
                      "name": "[parameters('sku')]"
                    },
                    "kind": "[parameters('kind')]"
                  }
                ]
              },
              "parameters": {
                "name": {
                  "value": "[field('name')]"
                },
                "sku": {
                  "value": "[field('Microsoft.Storage/storageAccounts/sku.name')]"
                },
                "location": {
                  "value": "[field('location')]"
                },
                "kind": {
                  "value": "[field('kind')]"
                }
              }
            }
          }
        }
      }
    }
  }
}

For more details, please refer to

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#deployifnotexists

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security#grant-access-from-a-virtual-network