问题描述
对Azure上的虚拟机资源，需要进行安全管理。只有指定的IP地址才能够通过RDP/SSH远程到虚拟机上, 有如下几点考虑：
1） 使用Azure Policy服务，扫描订阅中全部的网络安全组(NSG: Network Security Group) 资源
2） 判断入站规则，判断是否是3389, 22端口
3） 判断源地址是否是被允许的IP
4） 对不满足条件的 NSG规则进行审计。提示不合规( Non-compliant )
需要满足以上要求的规则，如何来编写呢？
问题解答
使用Azure Policy可以完成对Azure资源的集中管制，以满足合规需求。为满足以上需求：
第一步：检查NSG资源，查看Inbound ， port， source 值对应的属性名
在NSG的Overview页面，点击右上角的“JSON View”链接，查看资源的JSON内容，其中securityRules的内容为：
{"name": "RDP","id": "/subscriptions/x-x-x-x/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxxx-xxx/securityRules/RDP","etag": "W/\"xxxxxxx\"","type": "Microsoft.Network/networkSecurityGroups/securityRules","properties": {"provisioningState": "Succeeded","protocol": "TCP","sourcePortRange": "*","destinationPortRange": "3389","sourceAddressPrefix": "167.220.0.0/16","destinationAddressPrefix": "*","access": "Allow","priority": 300,"direction": "Inbound","sourcePortRanges": [],"destinationPortRanges": [],"sourceAddressPrefixes": [],"destinationAddressPrefixes": []} }
其中：
- 资源类型为 type = Microsoft.Network/networkSecurityGroups/securityRules
- inbound的属性名为 direction
- 3389端口的属性名为destinationPortRange
- 而IP地址属性名为sourceAddressPrefix
它们，就是组成Policy Rule的内容
第二步：编写 Policy Rule
Policy的总体框架是：
{"mode": "All","policyRule": {"if": {// 需要进行审计的条件//1： 资源的类型是 Microsoft.Network/networkSecurityGroups/securityRules //2： 入站规则 Inbound//3： 端口是3389 或 22//4： 如果不在允许的IP地址列表里，则需要审计},"then": {"effect": "audit"}},"parameters": {//输入参数，本例中是允许的IP地址列表} }
第一个条件：扫描资源的类型为网络安全组的安全规则
转换为Policy语句：
{"field": "type","equals": "Microsoft.Network/networkSecurityGroups/securityRules" }
第二个条件：判断规则的方向为入站方向
"direction": "Inbound"
转换为Policy语句：
{"field": "Microsoft.Network/networkSecurityGroups/securityRules/direction","equals": "Inbound"}
第三个条件：判断端口为3389 或 22
"destinationPortRange": "3389" 或 "destinationPortRange": "22"
转换为Policy语句：
{"anyOf": [{"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange","equals": "22"},{"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange","equals": "3389"}]}
第四个条件：判断IP地址，是否不在允许的列表中
"sourceAddressPrefix": "167.220.0.0/16"
转换为Policy语句：
{"field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix","notIn": "[parameters('allowedIPs')]"}
第三步：准备参数(允许的IP地址作为输入参数)
因为被允许的IP地址应该是多个，所以准备为一个Array对象, 参数名称为：allowedIPs。
结构如下：
"parameters": {"allowedIPs": {"type": "Array","metadata": {"displayName": "Allowed IPs","description": "The list of allowed IPs for resources."},"defaultValue": ["192.168.1.1"，"x.x.x.x"]}}
完整的Policy示例：
{"mode": "All","policyRule": {"if": {"allOf": [{"field": "type","equals": "Microsoft.Network/networkSecurityGroups/securityRules"},{"field": "Microsoft.Network/networkSecurityGroups/securityRules/direction","equals": "Inbound"},{"anyOf": [{"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange","equals": "22"},{"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange","equals": "3389"}]},{"field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix","notIn": "[parameters('allowedIPs')]"}]},"then": {"effect": "audit"}},"parameters": {"allowedIPs": {"type": "Array","metadata": {"displayName": "Allowed IPs","description": "The list of allowed IPs for resources."},"defaultValue": ["192.168.1.1","x.x.x.x"]}} }
最终效果：
参考资料
Using arrays in conditions： https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays#using-arrays-in-conditions
deny-nsg-inbound-allow-all： https://github.com/Azure/azure-policy/blob/master/samples/Network/deny-nsg-inbound-allow-all/azurepolicy.json
Azure Policy definitions audit effect： https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-audit
