ES-Deny-Subnets-Without-NSG

[pauldotyu]

The following policy does not exclude subnets that do not allow NSGs to be attached to it.

ES-Deny-Subnets-Without-NSG

So far, I know GatewaySubnet, AzureFirewallSubnet, and AzureFirewallManagementSubnet do not support NSG. There may be others...

Proposing the policy rule's "if" condition look like this:

"if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks/subnets"
          },
          {
            "field": "name",
            "notEquals": "AzureFirewallSubnet"
          },
          {
            "field": "name",
            "notEquals": "AzureFirewallManagementSubnet"
          },
          {
            "field": "name",
            "notEquals": "GatewaySubnet"
          },
          {
            "field": "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id",
            "exists": "false"
          }
        ]
      },