Topics_PublicNetworkAccess_Modify.json

{
  "properties": {
    "displayName": "Modify - Configure Azure Event Grid topics to disable public network access",
    "description": "Disable public network access for Azure Event Grid resource so that it isn't accessible over the public internet. This will help protect them against data leakage risks. You can limit exposure of the your resources by creating private endpoints instead. Learn more at: https://aka.ms/privateendpoints.",
    "metadata": {
      "category": "Event Grid",
      "version": "1.0.0"
    },
    "version": "1.0.0",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "Modify",
          "Disabled"
        ],
        "defaultValue": "Modify"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.EventGrid/topics"
          },
          {
            "field": "kind",
            "notEquals": "AzureArc"
          },
          {
            "field": "Microsoft.EventGrid/topics/publicNetworkAccess",
            "notEquals": "Disabled"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/1e241071-0855-49ea-94dc-649edcd759de"
          ],
          "conflictEffect": "audit",
          "operations": [
            {
              "condition": "[greaterOrEquals(requestContext().apiVersion, '2020-04-01-preview')]",
              "operation": "addOrReplace",
              "field": "Microsoft.EventGrid/topics/publicNetworkAccess",
              "value": "Disabled"
            }
          ]
        }
      }
    },
    "versions": [
      "1.0.0"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/36ea4b4b-0f7f-4a54-89fa-ab18f555a172",
  "name": "36ea4b4b-0f7f-4a54-89fa-ab18f555a172"
}