Azure / Azure/Azure-Landing-Zones
Deny-MgmtPorts-From-Internet.json
Open
Transfer From: Enterprise-Scale :arrow_right:
- Dominant language
- PowerShell
- Stars
- 96
- Forks
- 70
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 7
Description
**Describe the bug**
The policy checks for the source address to be * or Internet, but doesn't check for 0.0.0.0/0.
Per
"0.0.0.0/0 in the Source and Destination columns represents all addresses"
**Steps to reproduce**
1. Deploy policy in deny mode.
2. Create an NSG, and allow port 22 from 0.0.0.0/0 address range.
3. Note, policy is compliant.
Contributor guide
Research direction
No source file or test is named in the issue. Start by locating the Deny-MgmtPorts-From-Internet policy and reviewing how it identifies source addresses, then reproduce the NSG case with port 22 and 0.0.0.0/0. Done means the policy treats that range as an internet-wide source and reports the rule as noncompliant.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- cloud, networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100