用于检查应用程序服务的iPaddresses的Azure策略

Question

我正在尝试在Azure中创建一个策略，该策略是否在App Services包含的情况下审核允许从某个IP地址访问。

部署没有问题，但目前说我所有的资源都不合规，我不明白为什么，我确定有些人是投诉。

我正在尝试检查IP 12.23.456.789/32是否访问 这就是我尝试的（我正在使用二头肌作为IAC：

 resource ApimPRDPolicyDefinition 'Microsoft.Authorization/policyDefinitions@2020-09-01' = {
  name: 'allow-apim'
  properties: {
    displayName: 'Check if api allow apim'
    policyType: 'Custom'
    
    policyRule: {
      if: {
        allOf: [
          {
            field: 'type'
            equals: 'Microsoft.Web/sites'
          }
          {
            field: 'name'
            contains: 'api'
          }
          {
            field: 'name'
            contains: 'prd'
          }
        ]
      }
      then: {
        effect: 'auditIfNotExists'
        details: {         
          type: 'Microsoft.Web/sites/config'
          existenceCondition: {            
            field: 'Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].ipAddress'
            equals: '12.23.456.789/32'           
          }
        }

      }
    }
  }
}

这是我查看Azure Portal

{
  "properties": {
    "displayName": "Check if api allow apim",
    "policyType": "Custom",
    "mode": "Indexed",
    "metadata": {

    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Web/sites"
          },
          {
            "field": "name",
            "contains": "api"
          },
          {
            "field": "name",
            "contains": "prd"
          }
        ]
      },
      "then": {
        "effect": "auditIfNotExists",
        "details": {
          "type": "Microsoft.Web/sites/config",
          "existenceCondition": {
            "field": "Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].ipAddress",
            "equals": "12.23.456.789/32"
          }
        }
      }
    }
  },
  "id": "",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "allow-apim",
  "systemData": {
  }
}

类型的定义时的代码

Answer 1

我创建并测试了此策略，并且按照预期的方式工作：

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Web/sites"
        },
        {
          "field": "name",
          "contains": "api"
        },
        {
          "field": "name",
          "contains": "prd"
        }
      ]
    },
    "then": {
      "effect": "auditIfNotExists",
      "details": {
        "type": "Microsoft.Web/sites/config",
        "existenceCondition": {
            "count": {
                "field": "Microsoft.Web/sites/config/web.ipSecurityRestrictions[*]",
                "where": {
                    "field": "Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].ipAddress",
                    "equals": "12.23.123.123/32"
                }
            },
            "greater": 0
        }
      }
    }
  }
}

有用的文档：
https：https：https：// learch。 microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays