output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Network_20250326.json
|
{ "name": "Enforce-Guardrails-Network_20250326", "type": "Microsoft.Authorization/policySetDefinitions", "apiVersion": "2023-04-01", "scope": null, "properties": { "policyType": "Custom", "displayName": "Enforce recommended guardrails for Network and Networking services", "description": "This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.", "metadata": { "version": "2.0.0", "category": "Network", "source": "https://github.com/Azure/Enterprise-Scale/", "replacesPolicy": "Enforce-Guardrails-Network", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", "AzureUSGovernment" ] }, "parameters": { "subnetUdr": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "subnetNsg": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "subnetServiceEndpoint": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "appGwWaf": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "vnetModifyDdos": { "type": "string", "defaultValue": "Modify", "allowedValues": [ "Audit", "Modify", "Disabled" ] }, "ddosPlanResourceId": { "type": "string", "defaultValue": "" }, "wafMode": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "wafModeRequirement": { "type": "string", "defaultValue": "Prevention" }, "wafFwRules": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "wafModeAppGw": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "wafModeAppGwRequirement": { "type": "string", "defaultValue": "Prevention" }, "denyMgmtFromInternet": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "denyMgmtFromInternetPorts": { "type": "Array", "metadata": { "displayName": "Ports", "description": "Ports to be blocked" }, "defaultValue": [ "22", "3389" ] }, "wafAfdEnabled": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "vpnAzureAD": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "appGwTlsVersion": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", "Disabled" ] }, "modifyUdr": { "type": "string", "defaultValue": "Disabled" }, "modifyUdrNextHopIpAddress": { "type": "string", "defaultValue": "" }, "modifyUdrNextHopType": { "type": "string", "defaultValue": "None" }, "modifyUdrAddressPrefix": { "type": "string", "defaultValue": "0.0.0.0/0" }, "modifyNsg": { "type": "string", "defaultValue": "Disabled", "allowedValues": [ "Modify", "Disabled" ] }, "modifyNsgRuleName": { "type": "string", "defaultValue": "DenyAnyInternetOutbound" }, "modifyNsgRulePriority": { "type": "integer", "defaultValue": 1000 }, "modifyNsgRuleDirection": { "type": "string", "defaultValue": "Outbound" }, "modifyNsgRuleAccess": { "type": "string", "defaultValue": "Deny", "allowedValues": [ "Allow", "Deny" ] }, "modifyNsgRuleProtocol": { "type": "string", "defaultValue": "*" }, "modifyNsgRuleSourceAddressPrefix": { "type": "string", "defaultValue": "*" }, "modifyNsgRuleSourcePortRange": { "type": "string", "defaultValue": "*" }, "modifyNsgRuleDestinationAddressPrefix": { "type": "string", "defaultValue": "Internet" }, "modifyNsgRuleDestinationPortRange": { "type": "string", "defaultValue": "*" }, "modifyNsgRuleDescription": { "type": "string", "defaultValue": "Deny any outbound traffic to the Internet" } }, "policyDefinitions": [ { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010", "policyDefinitionReferenceId": "Deny-Nsg-GW-subnet", "definitionVersion": "1.*.*", "groupNames": [], "parameters": {} }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7", "policyDefinitionReferenceId": "Deny-VPN-AzureAD", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('vpnAzureAD')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/055aa869-bc98-4af8-bafc-23f1ab6ffe2c", "policyDefinitionReferenceId": "Deny-Waf-Afd-Enabled", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('wafAfdEnabled')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/12430be1-6cc8-4527-a9a8-e3d38f250096", "policyDefinitionReferenceId": "Deny-Waf-AppGw-mode", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('wafModeAppGw')]" }, "modeRequirement": { "value": "[[parameters('wafModeAppGwRequirement')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66", "policyDefinitionReferenceId": "Deny-Waf-Fw-rules", "definitionVersion": "2.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('wafFwRules')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/425bea59-a659-4cbb-8d31-34499bd030b8", "policyDefinitionReferenceId": "Deny-Waf-mode", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('wafMode')]" }, "modeRequirement": { "value": "[[parameters('wafModeRequirement')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/94de2ad3-e0c1-4caf-ad78-5d47bbc83d3d", "policyDefinitionReferenceId": "Modify-vNet-DDoS", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('vnetModifyDdos')]" }, "ddosPlan": { "value": "[[parameters('ddosPlanResourceId')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/88c0b9da-ce96-4b03-9635-f29a937e2900", "policyDefinitionReferenceId": "Deny-Ip-Forwarding", "definitionVersion": "1.*.*", "groupNames": [], "parameters": {} }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114", "policyDefinitionReferenceId": "Deny-vNic-Pip", "definitionVersion": "1.*.*", "groupNames": [], "parameters": {} }, { "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66", "policyDefinitionReferenceId": "Deny-AppGw-Without-Waf", "definitionVersion": "2.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('appGwWaf')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Udr", "policyDefinitionReferenceId": "Deny-Subnet-Without-Udr", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('subnetUdr')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Nsg", "policyDefinitionReferenceId": "Deny-Subnet-Without-NSG", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('subnetNsg')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-Service-Endpoints", "policyDefinitionReferenceId": "Deny-Subnet-with-Service-Endpoints", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('subnetServiceEndpoint')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-MgmtPorts-From-Internet", "policyDefinitionReferenceId": "Deny-Mgmt-From-Internet", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('denyMgmtFromInternet')]" }, "ports": { "value": "[[parameters('denyMgmtFromInternetPorts')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-AppGw-Without-Tls", "policyDefinitionReferenceId": "Deny-AppGw-Without-Tls", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('appGwTlsVersion')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Modify-UDR", "policyDefinitionReferenceId": "Modify-Udr", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('modifyUdr')]" }, "nextHopIpAddress": { "value": "[[parameters('modifyUdrNextHopIpAddress')]" }, "nextHopType": { "value": "[[parameters('modifyUdrNextHopType')]" }, "addressPrefix": { "value": "[[parameters('modifyUdrAddressPrefix')]" } } }, { "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Modify-NSG", "policyDefinitionReferenceId": "Modify-Nsg", "definitionVersion": "1.*.*", "groupNames": [], "parameters": { "effect": { "value": "[[parameters('modifyNsg')]" }, "nsgRuleName": { "value": "[[parameters('modifyNsgRuleName')]" }, "nsgRulePriority": { "value": "[[parameters('modifyNsgRulePriority')]" }, "nsgRuleDirection": { "value": "[[parameters('modifyNsgRuleDirection')]" }, "nsgRuleAccess": { "value": "[[parameters('modifyNsgRuleAccess')]" }, "nsgRuleProtocol": { "value": "[[parameters('modifyNsgRuleProtocol')]" }, "nsgRuleSourceAddressPrefix": { "value": "[[parameters('modifyNsgRuleSourceAddressPrefix')]" }, "nsgRuleSourcePortRange": { "value": "[[parameters('modifyNsgRuleSourcePortRange')]" }, "nsgRuleDestinationAddressPrefix": { "value": "[[parameters('modifyNsgRuleDestinationAddressPrefix')]" }, "nsgRuleDestinationPortRange": { "value": "[[parameters('modifyNsgRuleDestinationPortRange')]" }, "nsgRuleDescription": { "value": "[[parameters('modifyNsgRuleDescription')]" } } } ], "policyDefinitionGroups": null } } |