0

In Azure I have an NSG Rule configured as follows:

enter image description here

Im trying to write an Azure Policy, to audit if the Source IP addresses/CIDR ranges is not set correctly.

The value should always be exactly equal to: 192.168.0.0/24,192.168.1.0/24.

If it is not that exact value, it should audit.

This is the definition I have written:

{
    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.Network/networkSecurityGroups"
            },
            {
                "field": "name",
                "like": "jeffweb2-dr-sm-nsg"
            },
            {
                "count": {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
                    "where": {
                        "allOf": [
                            {
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].name",
                                "equals": "SQL"
                            },
                            {
                                "anyof": [
                                    {
                                        "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix",
                                        "notEquals": [
                                            "192.168.0.0/24",
                                            "192.168.1.0/24"
                                        ]
                                    }
                                ]
                            }
                        ]
                    }
                },
                "greater": 0
            }
        ]
    },
    "then": {
        "effect": "audit"
    }
}

But when trying to create the definition with this json, I get the error:

New-AzPolicyDefinition : InvalidPolicyRule : Failed to parse policy rule: 'Error reading string. Unexpected token: StartArray. Path 'notEquals'.'.

Question: How do you pass multiple CIDR ranges into the notEquals, I believe this is my problem I believe.

1

sourceAddressPrefix only supports a single IP range, you want to use sourceAddressPrefixes.

The UI in the portal hides this, but they are two different properties in ARM.

| improve this answer | |
  • Is the not equals value right being comma separated as it is still not working? – Jeffrey May 8 at 12:21
  • It wont let me pass in the array of CIDR's even when using sourceAddressPrefixes – Jeffrey May 8 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.