-
Notifications
You must be signed in to change notification settings - Fork 984
/
Copy pathENFORCE-SubnetPrivatePolicyAssignment.json
66 lines (66 loc) · 2.47 KB
/
ENFORCE-SubnetPrivatePolicyAssignment.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"effect": {
"type": "string",
"allowedValues": [
"Deny",
"Audit",
"Disabled"
],
"defaultValue": "Audit"
},
"enforcementMode": {
"type": "string",
"allowedValues": [
"Default",
"DoNotEnforce"
],
"defaultValue": "Default"
},
"nonComplianceMessagePlaceholder": {
"type": "string",
"defaultValue": "{enforcementMode}"
}
},
"variables": {
"policyDefinitions": {
"privateSubnet": "/providers/Microsoft.Authorization/policyDefinitions/7bca8353-aa3b-429b-904a-9229c4385837"
},
"policyAssignmentNames": {
"privateSubnet": "Enforce-Subnet-Private",
"description": "Ensure your subnets are secure by default by preventing default outbound access. For more information go to https://aka.ms/defaultoutboundaccessretirement",
"displayName": "Subnets should be private"
},
"nonComplianceMessage": {
"message": "Subnets {enforcementMode} be private.",
"Default": "must",
"DoNotEnforce": "should"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2022-06-01",
"name": "[variables('policyAssignmentNames').privateSubnet]",
"properties": {
"description": "[variables('policyAssignmentNames').description]",
"displayName": "[variables('policyAssignmentNames').displayName]",
"policyDefinitionId": "[variables('policyDefinitions').privateSubnet]",
"enforcementMode": "[parameters('enforcementMode')]",
"nonComplianceMessages": [
{
"message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]"
}
],
"parameters": {
"effect": {
"value": "[parameters('effect')]"
}
}
}
}
],
"outputs": {}
}