azure policy 可以检测资源的变化吗？

Question

我希望使用 azure 策略检测我的订阅中 nsg（网络安全组）的安全规则何时发生任何变化。

但是，我在资源中找不到任何可以监控以检测更改的属性/别名。 以下是 azure policy extension on vs code 显示的属性

{
  "id": "/subscriptions/xxxx/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxx",
  "name": "xxxx",
  "type": "Microsoft.Network/networkSecurityGroups",
  "location": "eastus",
  "tags": {
    "Company": "xxx"
  },
  "properties": {
    "provisioningState": "Succeeded",
    "resourceGuid": "xxxx",
    "securityRules": [],
    "defaultSecurityRules": [
      {
        "name": "AllowVnetInBound",
        "id": "/subscriptions/xxxxx/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxxx/defaultSecurityRules/AllowVnetInBound",
        "etag": "xxxx,
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow inbound traffic from all VMs in VNET",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefix": "VirtualNetwork",
          "access": "Allow",
          "priority": 65000,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "AllowAzureLoadBalancerInBound",
        "id": "/subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/nxxxx/defaultSecurityRules/AllowAzureLoadBalancerInBound",
        "etag": "W/\"9613f8c0-57ab-40fd-83e0-8da551bd3d96\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow inbound traffic from azure load balancer",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "AzureLoadBalancer",
          "destinationAddressPrefix": "*",
          "access": "Allow",
          "priority": 65001,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "DenyAllInBound",
        "id": "/subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxxx/defaultSecurityRules/DenyAllInBound",
        "etag": "xxx",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Deny all inbound traffic",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "*",
          "access": "Deny",
          "priority": 65500,
          "direction": "Inbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "AllowVnetOutBound",
        "id": "/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxxx/defaultSecurityRules/AllowVnetOutBound",
        "etag": "xxx",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow outbound traffic from all VMs to all VMs in VNET",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "VirtualNetwork",
          "destinationAddressPrefix": "VirtualNetwork",
          "access": "Allow",
          "priority": 65000,
          "direction": "Outbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "AllowInternetOutBound",
        "id": "/subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Network/networkSecurityGroups/xxx/defaultSecurityRules/AllowInternetOutBound",
        "etag": "W/\"9613f8c0-57ab-40fd-83e0-8da551bd3d96\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Allow outbound traffic from all VMs to Internet",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "Internet",
          "access": "Allow",
          "priority": 65001,
          "direction": "Outbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      },
      {
        "name": "DenyAllOutBound",
        "id": "/subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.Network/networkSecurityGroups/xxxx/defaultSecurityRules/DenyAllOutBound",
        "etag": "W/\"9613f8c0-57ab-40fd-83e0-8da551bd3d96\"",
        "type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
        "properties": {
          "provisioningState": "Succeeded",
          "description": "Deny all outbound traffic",
          "protocol": "*",
          "sourcePortRange": "*",
          "destinationPortRange": "*",
          "sourceAddressPrefix": "*",
          "destinationAddressPrefix": "*",
          "access": "Deny",
          "priority": 65500,
          "direction": "Outbound",
          "sourcePortRanges": [],
          "destinationPortRanges": [],
          "sourceAddressPrefixes": [],
          "destinationAddressPrefixes": []
        }
      }
    ]
  }
}

我尝试针对活动日志事件制定策略以检测更改。但是事实证明，您不能直接针对事件日志制定策略。我有没有其他方法可以检测安全规则是否已更改？

Answer 1

没有。您不能制定策略来监控事件。策略旨在针对资源状态进行审计。因此，您可以指定某个属性并在给定要监视的正确别名的情况下审核该属性的状态。策略将根据您的更改策略规则自动评估该资源状态。但是更改事件本身无法通过 Policy 进行监控。