At current client we had a request to apply a policy to enforce that only VNets using specified IP address ranges and regions will be allowed. So for example, if you create a VNet in West Europe, then it must be within the 10.100.0.0/16 IP address space and if in North Europe it must be within 10.200.0.0/16 and 10.201.0.0/16. And anything outside that must be denied.
There is no built-in policy for this. It was possible to find simpler versions online of the above but we couldn't find anything that fit all the requirements.
The closest we got was a slimmed down version of this policy from AzPolicyAdvertizer named "Address space must be pre-allocated for region".
However, it didn't take into account extended VNets. So if you have a VNet consisting of two or more IP address ranges, it will show as non-compliant.
We raised a ticket with Microsoft support and after a few days they came back with an updated policy that works.
The functioning policy can be found here on Github. The only thing that needs to be updated is the content of the "spokeAllocations" array.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.