azurepolicy/policy-definitions/action-groups/pol-ag-deny-http-webhooks.json at master · TaoYang-Cloud/azurepolicy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
{
  "name": "pol-ag-deny-http-webhooks",
  "properties": {
    "displayName": "Restrict Azure Monitor Action Group Trigger Actions to Webhooks that are not using HTTPS",
    "description": "Deny Azure Monitor Action Groups that trigger actions to Webhooks that are not using HTTPS.",
    "metadata": {
      "category": "Monitoring",
      "version": "1.0.0",
      "preview": false,
      "depreciated": false
    },
    "mode": "Indexed",
    "parameters": {
      "effect": {
        "type": "string",
        "metadata": {
          "displayName": "Effect",
          "description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
        },
        "allowedValues": [
          "Audit",
          "Deny",
          "Disabled"
        ],
        "defaultValue": "Deny"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Insights/actiongroups"
          },
          {
            "count": {
              "field": "Microsoft.Insights/actiongroups/webhookReceivers[*]",
              "where": {
                "field": "Microsoft.Insights/actiongroups/webhookReceivers[*].serviceUri",
                "like": "http://*"
              }
            },
            "greater": 0
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]"
      }
    }
  }
}