shared_nsg_rules_azpolicy_allowLB.json

{
    "mode": "All",
    "parameters": {
        "effect": {
            "type": "String",
            "metadata": {
                "displayName": "Effect",
                "description": "Enable or disable the execution of the policy"
            },
            "allowedValues": [
                "DoNotEnforce",
                "deployIfNotExists"
            ],
            "defaultValue": "deployIfNotExists"
        },
        "priority": {
            "type": "Integer",
            "metadata": {
                "displayName": "priority",
                "description": "Priority for the deny any-to-any security rule (Example 4090).",
                "defaultValue": 4090
            }
        }
    },
    "policyRule": {
        "if": {
            "field": "type",
            "equals": "Microsoft.Network/networkSecurityGroups"
        },
        "then": {
            "effect": "[parameters('effect')]",
            "details": {
                "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                "roleDefinitionIds": [
                    "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
                ],
                "existenceCondition": {
                    "allof": [
                        {
                            "field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
                            "equals": "Deny"
                        },
                        {
                            "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
                            "equals": "Inbound"
                        },
                        {
                            "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                            "equals": "*"
                        }
                    ]
                },
                "deployment": {
                    "properties": {
                        "mode": "incremental",
                        "parameters": {
                            "nsgName": {
                                "value": "[field('name')]"
                            },
                            "priority": {
                                "value": "[parameters('priority')]"
                            }
                        },
                        "template": {
                            "$schema": "http://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                            "contentVersion": "1.0.0.0",
                            "parameters": {
                                "nsgName": {
                                    "type": "string"
                                },
                                "priority": {
                                    "type": "int"
                                }
                            },
                            "resources": [
                                {
                                    "name": "[concat(parameters('nsgName'),'/Allow_ALB_Inbound')]",
                                    "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                                    "apiVersion": "2019-11-01",
                                    "properties": {
                                        "description": "Allow Azure Load Balancer source IP address",
                                        "protocol": "*",
                                        "sourcePortRange": "168.63.129.16",
                                        "destinationPortRange": "*",
                                        "sourceAddressPrefix": "*",
                                        "destinationAddressPrefix": "*",
                                        "access": "Allow",
                                        "priority": "[parameters('priority')]",
                                        "direction": "Inbound"
                                    }
                                }
                            ]
                        }
                    }
                }
            }
        }
    }
}