Azure / Azure/azure-policy

Alias request: Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id

Open
#889 0 comments 0 reactions 0 assignees View on GitHub
alias-request
Dominant language
Open Policy Agent
Stars
1.7k
Forks
1.2k
Avg merge
2d 54m
Merged PRs (30d)
3

Description

#### Details of the scenario you tried and the problem that is occurring

Need to create policy preventing attachment of network interfaces to a subnet which hasn't been secured with a route table (UDR). This currently fails with an error as the alias does not exist.

#### Verbose logs showing the problem

n/a

#### Suggested solution to the issue

Register the alias `Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id` to support creating a policy definition such as the following:

```json
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/networkInterfaces"
},
{
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.name",
"notIn": "[parameters('excludedSubnets')]"
},
{
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id",
"exists": "false"
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
},
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Deny"
},
"excludedSubnets": {
"type": "Array",
"metadata": {
"displayName": "Excluded Subnets",
"description": "Array of subnet names that are excluded from this policy"
},
"defaultValue": [
"GatewaySubnet",
"AzureFirewallSubnet",
"AzureFirewallManagementSubnet"
]
}
}
}
```

#### If policy is Guest Configuration - details about target node

n/a

Contributor guide

No contributing guide indexed for this repository

Research direction

The requested entry point is the Azure Policy alias Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id, and the issue includes a sample policy definition. Start by reviewing how network-interface aliases are registered in this repository. Verify that the alias supports the shown exists condition and that the sample policy no longer fails because the alias is missing.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.