Feature Request - combination Deny vNet peering cross subscription & Deny-VNET-Peering-To-Non-Approved-VNETs

Azure / Enterprise-Scale

The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture

MIT License

1.65k stars 932 forks source link

szenario:

HubToSpoke Peering done by: Deny-VNET-Peering-To-Non-Approved-VNETs => fine
subscription intneral peering: Deny vNet peering cross subscription => fine

but if we've got an HubToSpoke Subscription with internal vnet peering. This won't work with these to Policy.

Suggestion:

Option A) Deny-VNET-Peering-To-Non-Approved-VNETs
- add an option to allow inner subscription peering
Option B) Deny vNet peering cross subscription
- add an excludelist of vnet ids which are ok to do cross subscriptions

or both ;-)

Azure / Enterprise-Scale

Feature Request - combination Deny vNet peering cross subscription & Deny-VNET-Peering-To-Non-Approved-VNETs #1674