Azure Policy to deny creation of Network Interfaces without NSG attached

Question

Hey I am looking to assign Azure Policy which will deny creation of Network Interfaces without NSG attached.

I looked with build-in role and couldn't find anything related. Maybe someone have script that does the job.

Thanks for your help in advance.

Answer 1

I tried to create the azure policy to deny creation of network interface without NSG

I have created the policy definition named network

In the policy rule write the below json script to create the policy rules to deny the virtual network without NSG rules I took the example reference from git URL @withstu

 {
      "name": "Deny-Subnet-Without-Nsg",
      "type": "Microsoft.Authorization/policyDefinitions",
      "apiVersion": "2022-11-22",
      "scope": null,
      "properties": {
        "policyType": "Custom",
        "mode": "All",
        "displayName": "Subnets should have a Network Security Group",
        "description": " policy will deny the creation of a network/subnet with out an NSG.",
        "metadata": {
          "version": "1.1.0",
          "category": "Network"
        },
        "parameters": {
          "effect": {
            "type": "String",
            "allowedValues": [
              "Audit",
              "Deny",
              "Disabled"
            ],
            "defaultValue": "Deny",
            "metadata": {
              "displayName": "Effect",
              "description": " disable the execution of the policy"
            }
          },
          "excludedSubnets": {
            "type": "Array",
            "metadata": {
              "displayName": "Excluded Subnets",
              "description": "subnets excluded from this policy"
            },
            "defaultValue": [
              "GatewaySubnet",
              "AzureFirewallSubnet",
              "AzureFirewallManagementSubnet"
            ]
          }
        },
        "policyRule": {
          "if": {
            "anyOf": [
              {
                "allOf": [
                  {
                    "equals": "Microsoft.Network/virtualNetworks",
                    "field": "type"
                  },
                  {
                    "exists": "false",
                    "field": "Microsoft.Network/virtualNetworks/subnets[*].networkSecurityGroup.id"
                  }
                ]
              },
              {
                "allOf": [
                  {
                    "equals": "Microsoft.Network/virtualNetworks/subnets",
                    "field": "type"
                  },
                  {
                    "field": "name",
                    "notIn": "[parameters('excludedSubnets')]"
                  },
                  {
                    "exists": "false",
                    "field": "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id"
                  }
                ]
              }
            ]
          },
          "then": {
            "effect": "[parameters('effect')]"
          }
        }
      }
    }

I have assigned the policy to the policy definition

In left side of the menu click on Assignment => click on assign policy and added the appropriate fields to create

After assigning the polices it will take 30 minutes to reflect

I am trying to creating the virtual network , I got the error because of deny subnet without NSG