问题描述
对Azure上的虚拟机资源，需要进行安全管理。只有指定的IP地址才能够通过RDP/SSH远程到虚拟机上, 有如下几点考虑：
1） 使用Azure Policy服务，扫描订阅中全部的网络安全组(NSG: Network Security Group) 资源
2） 判断入站规则，判断是否是3389, 22端口
3） 判断源地址是否是被允许的IP
4） 对不满足条件的 NSG规则进行审计。提示不合规( Non-compliant )
需要满足以上要求的规则，如何来编写呢？
问题解答
使用Azure Policy可以完成对Azure资源的集中管制，以满足合规需求。为满足以上需求：
第一步：检查NSG资源，查看Inbound ， port， source 值对应的属性名
在NSG的Overview页面，点击右上角的“JSON View”链接，查看资源的JSON内容，其中securityRules的内容为：
{
"name": "RDP",
"id": "/subscriptions/x-x-x-x/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxxx-xxx/securityRules/RDP",
"etag": "W/\"xxxxxxx\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "167.220.0.0/16",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 300,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
其中：
- 资源类型为 type = Microsoft.Network/networkSecurityGroups/securityRules
- inbound的属性名为 direction
- 3389端口的属性名为destinationPortRange
- 而IP地址属性名为sourceAddressPrefix
它们，就是组成Policy Rule的内容
第二步：编写 Policy Rule
Policy的总体框架是：
{
"mode": "All",
"policyRule": {
"if": {
// 需要进行审计的条件
//1： 资源的类型是 Microsoft.Network/networkSecurityGroups/securityRules
//2： 入站规则 Inbound
//3： 端口是3389 或 22
//4： 如果不在允许的IP地址列表里，则需要审计
},
"then": {
"effect": "audit"
}
},
"parameters": {
//输入参数，本例中是允许的IP地址列表
}
}
第一个条件：扫描资源的类型为网络安全组的安全规则
"type": "Microsoft.Network/networkSecurityGroups/securityRules"
转换为Policy语句：
{
"field": "type",
"equals": "Microsoft.Network/networkSecurityGroups/securityRules"
}
第二个条件：判断规则的方向为入站方向
"direction": "Inbound"
转换为Policy语句：
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
"equals": "Inbound"
}
第三个条件：判断端口为3389 或 22
"destinationPortRange": "3389" 或 "destinationPortRange": "22"
转换为Policy语句：
{
"anyOf": [
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
"equals": "22"
},
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
"equals": "3389"
}
]
}
第四个条件：判断IP地址，是否不在允许的列表中
"sourceAddressPrefix": "167.220.0.0/16"
转换为Policy语句：
{
"field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
"notIn": "[parameters('allowedIPs')]"
}
第三步：准备参数(允许的IP地址作为输入参数)
因为被允许的IP地址应该是多个，所以准备为一个Array对象, 参数名称为：allowedIPs。
结构如下：
"parameters": {
"allowedIPs": {
"type": "Array",
"metadata": {
"displayName": "Allowed IPs",
"description": "The list of allowed IPs for resources."
},
"defaultValue": [
"192.168.1.1"，"x.x.x.x"
]
}
}
完整的Policy示例：
{ "mode": "All", "policyRule": { "if": { "allOf": [ { "field": "type", "equals": "Microsoft.Network/networkSecurityGroups/securityRules" }, { "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction", "equals": "Inbound" }, { "anyOf": [ { "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange", "equals": "22" }, { "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange", "equals": "3389" } ] }, { "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix", "notIn": "[parameters('allowedIPs')]" } ] }, "then": { "effect": "audit" } }, "parameters": { "allowedIPs": { "type": "Array", "metadata": { "displayName": "Allowed IPs", "description": "The list of allowed IPs for resources." }, "defaultValue": [ "192.168.1.1","x.x.x.x" ] } } }
最终效果：
参考资料
Using arrays in conditions： https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays#using-arrays-in-conditions
deny-nsg-inbound-allow-all： https://github.com/Azure/azure-policy/blob/master/samples/Network/deny-nsg-inbound-allow-all/azurepolicy.json
Azure Policy definitions audit effect： https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-audit
当在复杂的环境中面临问题，格物之道需：浊而静之徐清，安以动之徐生。 云中，恰是如此!
