I understand the approach in the article "Step-by-Step: Automate Building Outbound Network Security Groups Rules via Azure Resource Manager (ARM) and PowerShell": Allow all internally used IP-subnets used by Azure and then block the outbound Internet traffic.
But I think this list of subnets is not static, today there are 437 subnets for West-Europe, which is near to the maximum of 500 NSG rules per NSG.
Resources like storage or Linux repositories use some of these subnets. They are not accessed with static IPs, there are Load Balancers deciding about the used service and its IP address. That's the reason to open all Azure subnets.
I have the requirement to block all traffic to "real Internet servers" and also make the needed internal services accessible.
- When there are new subnets added and a Load Balancer decides to
assign a service in this new subnet to my request, I will not be able to access it? This could result in a service degradation of my application. Is that correct?
- Are the newly announced "Service Endpoints" a solution for this problem?
- Is it planned to introduce another Default Tag usable in NSG rules in addition to "VirtualNetwork","AzureLoadBalancer" and "Internet" to address "External Internet" or "Azure Internal"?
Thanks in advance!