Policy Packs

guardrails-samples

Ensure remote administrative access is blocked unless explicitly allowed, reducing the risk of malicious attacks and enhancing overall security posture.

Enforce Azure Network Security Groups to Reject All Ingress, RDP, and SSH Inbound Access

main

azure_network_security_group_ingress_rules_approved

Configure Network Security Group Ingress Rule checking. This policy defines whether&#92;nto verify the security group ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items. Rules for all `Approved`&#92;npolicies will be compiled in `Approved &gt; Compiled Rules` and then&#92;nevaluated.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the security group.&#92;n

networkSecurityGroupIngressRulesApproved

Azure > Network > Network Security Group > Ingress Rules > Approved

azure_network_security_group_ingress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject security group rules.&#92;n&#92;nNote that the Approved control does not operate directly from this policy,&#92;nbut from the `Approved &gt; Compiled Rules`. The rules are processed in order,&#92;nand any built-in Guardrails rules will appear first in the list of compiled&#92;nrules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Allow all rules from security groups in this account&#92;n  APPROVE $.UserIdGroupPairs.+.UserId:&quot;969297701313&quot;&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

Developers