Audit-Route-NextHopVirtualAppliance.json

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "variables": {
        "policyName": "Audit-Route-NextHopVirtualAppliance",
        "policyDescription": "Audit route tables for route with address prefix 0.0.0.0/0 pointing to the virtual appliance.",
        "policyCategory": "Network",
        "policyAssignmentParameters": {
            "routeTableSettings": {
                "value": {
                    "northeurope": {
                        "virtualApplianceIpAddress": "10.0.0.23"
                    },
                    "westeurope": {
                        "virtualApplianceIpAddress": "10.1.0.23"
                    },
                    "disabled": {
                        "virtualApplianceIpAddress": ""
                    }
                }
            }
        }
    },
    "resources": [
        {
            "name": "[variables('policyName')]",
            "type": "Microsoft.Authorization/policyDefinitions",
            "apiVersion": "2020-03-01",
            "properties": {
                "policyType": "Custom",
                "mode": "All",
                "displayName": "[variables('policyName')]",
                "description": "[variables('policyDescription')]",
                "metadata": {
                    "category": "[variables('policyCategory')]"
                },
                "parameters": {
                    "routeTableSettings": {
                        "type": "Object",
                        "metadata": {
                            "displayName": "Route Table Settings",
                            "description": "Location-specific settings for route tables."
                        }
                    }
                },
                "policyRule": {
                    "if": {
                        "allOf": [
                            {
                                "field": "type",
                                "equals": "Microsoft.Network/routeTables"
                            },
                            {
                                "count": {
                                    "field": "Microsoft.Network/routeTables/routes[*]",
                                    "where": {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Network/routeTables/routes[*].addressPrefix",
                                                "equals": "0.0.0.0/0"
                                            },
                                            {
                                                "field": "Microsoft.Network/routeTables/routes[*].nextHopType",
                                                "equals": "VirtualAppliance"
                                            },
                                            {
                                                "field": "Microsoft.Network/routeTables/routes[*].nextHopIpAddress",
                                                "equals": "[[parameters('routeTableSettings')[field('location')].virtualApplianceIpAddress]"
                                            }
                                        ]
                                    }
                                },
                                "equals": 0
                            }
                        ]
                    },
                    "then": {
                        "effect": "audit"
                    }
                }
            }
        },
        {
            "name": "[uniqueString(variables('policyName'))]",
            "type": "Microsoft.Authorization/policyAssignments",
            "apiVersion": "2020-03-01",
            "properties": {
                "displayName": "[variables('policyName')]",
                "policyDefinitionId": "[resourceId('Microsoft.Authorization/policyDefinitions', variables('policyName'))]",
                "parameters": "[variables('policyAssignmentParameters')]",
                "description": "[variables('policyDescription')]",
                "metadata": {
                    "category": "[variables('policyCategory')]"
                },
                "enforcementMode": "Default"
            },
            "dependsOn": [
                "[resourceId('Microsoft.Authorization/policyDefinitions', variables('policyName'))]"
            ]
        }
    ]
}