Azure / Enterprise-Scale

The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture
https://aka.ms/alz
MIT License
1.72k stars 980 forks source link

Fix: Updated Deny-MgmtPorts-From-Internet.json to recognize 0.0.0.0/0 as being equivalent to * to represent all remote IP addresses #1768

Closed rybal06 closed 4 weeks ago

rybal06 commented 2 months ago

Overview/Summary

Replace this with a brief description of what this Pull Request fixes, changes, etc.

This PR fixes/adds/changes/removes

  1. The policy checks for the source address to be * or Internet, but doesn't check for 0.0.0.0/0. Per https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview "0.0.0.0/0 in the Source and Destination columns represents all addresses"

Breaking Changes

  1. Any deployed NSG's which were previously bypassing this policy by using 0.0.0.0/0 will be denied as non-compliant.

Testing Evidence

nsg1 nsg2

Testing URLs

The below URLs can be updated where the placeholders are, look for {YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also} & {YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}, to allow you to test your portal deployment experience.

Please also replace the curly brackets on the placeholders {}

Azure Public

Deploy To Azure

Azure US Gov (Fairfax)

Deploy To Azure

As part of this Pull Request I have

jtracey93 commented 2 months ago

@rybal06 could you reply to the CLA bot please (https://github.com/Azure/Enterprise-Scale/pull/1768#issuecomment-2354143694) then we can get onto reviewing this 👍