Alias request: Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id
- Dominant language
- Open Policy Agent
- Stars
- 1.7k
- Forks
- 1.2k
- Avg merge
- 2d 54m
- Merged PRs (30d)
- 3
Description
#### Details of the scenario you tried and the problem that is occurring
Need to create policy preventing attachment of network interfaces to a subnet which hasn't been secured with a route table (UDR). This currently fails with an error as the alias does not exist.
#### Verbose logs showing the problem
n/a
#### Suggested solution to the issue
Register the alias `Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id` to support creating a policy definition such as the following:
```json
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/networkInterfaces"
},
{
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.name",
"notIn": "[parameters('excludedSubnets')]"
},
{
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id",
"exists": "false"
}
]
},
"then": {
"effect": "[parameters('effect')]"
}
},
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Audit",
"Deny",
"Disabled"
],
"defaultValue": "Deny"
},
"excludedSubnets": {
"type": "Array",
"metadata": {
"displayName": "Excluded Subnets",
"description": "Array of subnet names that are excluded from this policy"
},
"defaultValue": [
"GatewaySubnet",
"AzureFirewallSubnet",
"AzureFirewallManagementSubnet"
]
}
}
}
```
#### If policy is Guest Configuration - details about target node
n/a
Contributor guide
No contributing guide indexed for this repository
Research direction
The requested entry point is the Azure Policy alias Microsoft.Network/networkInterfaces/ipConfigurations[*].subnet.routeTable.id, and the issue includes a sample policy definition. Start by reviewing how network-interface aliases are registered in this repository. Verify that the alias supports the shown exists condition and that the sample policy no longer fails because the alias is missing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100