Azure 策略不拒绝创建路由

Question

I want to make an Azure policy that denies anyone trying to create a route to certain prefixes that don't use the next hop virtual appliance parameter and IP that I specify. I have this working with just a single prefix (0.0.0.0/0 inte.net route) but as soon as I try to define other routes (10.0.0.0/8) it doesn't work. Here is what I have so far:

{
    "mode": "All",
    "policyRule": {
        "if": {
            "anyOf": [
                {
                    "allOf": [
                        {
                            "field": "type",
                            "equals": "Microsoft.Network/routeTables"
                        },
                        {
                            "count": {
                                "field": "Microsoft.Network/routeTables/routes[*]",
                                "where": {
                                    "anyOf": [
                                        {
                                            "field": "Microsoft.Network/routeTables/routes[*].addressPrefix",
                                            "equals": "0.0.0.0/0"
                                        },
                                        {
                                            "anyOf": [
                                                {
                                                    "field": "Microsoft.Network/routeTables/routes[*].nextHopType",
                                                    "notEquals": "VirtualAppliance"
                                                },
                                                {
                                                    "field": "Microsoft.Network/routeTables/routes[*].nextHopIpAddress",
                                                    "notEquals": "[parameters('routeTableSettings')[field('location')].virtualApplianceIpAddress]"
                                                }
                                            ]
                                        },
                                        {
                                            "field": "Microsoft.Network/routeTables/routes[*].addressPrefix",
                                            "equals": "10.0.0.0/8"
                                        },
                                        {
                                            "anyOf": [
                                                {
                                                    "field": "Microsoft.Network/routeTables/routes[*].nextHopType",
                                                    "notEquals": "VirtualAppliance"
                                                },
                                                {
                                                    "field": "Microsoft.Network/routeTables/routes[*].nextHopIpAddress",
                                                    "notEquals": "[parameters('routeTableSettings')[field('location')].virtualApplianceIpAddress]"
                                                }
                                            ]
                                        }
                                    ]
                                }
                            },
                            "greater": 0
                        }
                    ]
                },
                {
                    "anyOf": [
                        {
                            "field": "type",
                            "equals": "Microsoft.Network/routeTables/routes"
                        },
                        {
                            "field": "Microsoft.Network/routeTables/routes[*].addressPrefix",
                            "equals": "0.0.0.0/0"
                        },
                        {
                            "anyOf": [
                                {
                                    "field": "Microsoft.Network/routeTables/routes/nextHopType",
                                    "notEquals": "VirtualAppliance"
                                },
                                {
                                    "field": "Microsoft.Network/routeTables/routes/nextHopIpAddress",
                                    "notEquals": "[parameters('routeTableSettings')[field('location')].virtualApplianceIpAddress]"
                                }
                            ]
                        },
                        {
                            "field": "type",
                            "equals": "Microsoft.Network/routeTables/routes"
                        },
                        {
                            "field": "Microsoft.Network/routeTables/routes[*].addressPrefix",
                            "equals": "10.0.0.0/8"
                        },
                        {
                            "anyOf": [
                                {
                                    "field": "Microsoft.Network/routeTables/routes/nextHopType",
                                    "notEquals": "VirtualAppliance"
                                },
                                {
                                    "field": "Microsoft.Network/routeTables/routes/nextHopIpAddress",
                                    "notEquals": "[parameters('routeTableSettings')[field('location')].virtualApplianceIpAddress]"
                                }
                            ]
                        }
                    ]
                }
            ]
        },
        "then": {
            "effect": "deny"
        }
    },
    "parameters": {
        "routeTableSettings": {
            "type": "Object",
            "metadata": {
                "displayName": "Route Table Settings",
                "description": "Location-specific settings for route tables."
            }
        }
    }
}

Parameters

{
    "eastus2": {
        "virtualApplianceIpAddress": "10.1.1.1"
    },
    "disabled": {
        "virtualApplianceIpAddress": ""
    }
}

Answer 1

To achieve the above requirement we need to use IN clause in our azure policy to deny/not allow the resource type to create.

As suggested by @ harshavmb in comment which is correct. Posting it as an answer to help other community members to find fix their issue for the same. The MS DOC has an example how to use the in with policy rule:

{
    "properties": {
        "displayName": "Allowed locations",
        "description": "This policy enables you to restrict the locations your organization can specify when deploying resources.",
        "mode": "Indexed",
        "metadata": {
            "version": "1.0.0",
            "category": "Locations"
        },
        "parameters": {
            "allowedLocations": {
                "type": "array",
                "metadata": {
                    "description": "The list of locations that can be specified when deploying resources",
                    "strongType": "location",
                    "displayName": "Allowed locations"
                },
                "defaultValue": [ "westus2" ]
            }
        },
        "policyRule": {
            "if": {
                "not": {
                    "field": "location",
                    "in": "[parameters('allowedLocations')]"
                }
            },
            "then": {
                "effect": "deny"
            }
        }
    }
}

Also from Azure portal>Policy> Not allowed resource we can find the json with in clause. As shown below:

For more information please refer the below links:-

MICROSOFT DOCUMENTATION:- Not_allowed_resource_types

BLOG:- AZURE POLICY TO DENY CREATION OF ALL RESOURCES