Azure Policy to deny creation of specific NSG priority rule

Question

Hello, I am looking for some suggestion with below implementation.

We have plan to reserve of the NSG Inbound & Outbound priorities ranges (eg. 100-200 ) and policy should deny the creation of NSG & NSG update rules within these ranges.

Can you please suggest, if its possible to implement this scenario, If there is already script is available for this, - Please share.

Thank you.

Answer 1

Hi,

I can share you the sample logic, please verify the syntax and apply to your Azure policy:

{
"field": "type",
"equals": "Microsoft.Network/networkSecurityGroups/securityRules"
},
{
"anyOf": [
{
"allOf": [
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/priority",
"greaterOrEquals": 100
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/priority",
"lessOrEquals": 200
}
]
}

"then": {
"effect": "deny"
}