An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl) with a list of filter rules to approve or reject security group rules. Note that the Approved control does not operate directly from this policy, but from the `Approved &gt; Compiled Rules`. The rules are processed in order, and any built-in Guardrails rules will appear first in the list of compiled rules. Examples: ``` Allow HTTP and HTTPS rules for RFC1918 private space APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 Allow all rules from security groups in this account APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot; Reject any rule from 0.0.0.0/0 REJECT $.turbot.cidr:0.0.0.0/0 ```

Azure > Network > Network Security Group > Ingress Rules

Azure > Network > Network Security Group > Ingress Rules > Approved

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject security group rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Guardrails rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Allow all rules from security groups in this account&#92;n  APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot;&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

azure_network_network_security_group_ingress_rules_approved_rules

Azure CIS v2.0.0 - Section 4 - Database Services

Schema Type	`string`
Default	`# Approve unmatched rules APPROVE *`

Policy: Azure > Network > Network Security Group > Ingress Rules > Approved > Rules

Resource Types

Primary Policy

Controls

Policy Packs

Policy Specification

Category

In Your Workspace

Developers