Challenges in creating custom policy rule to 'Deny VNet peering between subscriptions of "corp" & "online" management groups in Azure ESLZ'

Challenges in creating custom policy rule to 'Deny VNet peering between subscriptions of "corp" & "online" management groups

To achive the configuration by defining an Azure Policy that stops virtual network peering between a corporate VNet and an online VNet unless the address prefixes match those allowed within a parameterized list.

In this the issue is when you establish VNet peering in Azure, it creates two peerings oneway in the source VNet and one in the destination VNet. These are different resources and also make a note to that the policy should account for both directions of the peering relationship.

Updated policy:

{
  "properties": {
    "displayName": "Deny unauthorized virtual network peerings",
    "description": "Denies the creation of virtual network peerings if they do not match the specified corporate address ranges.",
    "mode": "All",
    "parameters": {
      "corpVNetAddressPrefixes": {
        "type": "Array",
        "metadata": {
          "displayName": "Corp VNet Address Prefixes",
          "description": "The list of Corp Subscription VNets address prefixes."
        },
        "defaultValue": [
          "17.0.0.0/24"
        ]
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings"
          },
          {
            "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetwork.id",
            "notcontains": "[subscription().id]"
          },
          {
            "anyOf": [
              {
                "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetworkAddressSpace.addressPrefixes[*]",
                "in": "[parameters('corpVNetAddressPrefixes')]"
              },
              {
                "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/localVirtualNetworkAddressSpace.addressPrefixes[*]",
                "in": "[parameters('corpVNetAddressPrefixes')]"
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Demo configuration:

Here for the convience I have set the configuration using the same Subscription as dont have the privilage for mulitiple

resource "azurerm_virtual_network" "corp_vnet" {
  name                = "corp-vnet"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = [var.corp_vnet_address_prefix]
}

resource "azurerm_virtual_network" "online_vnet" {
  name                = "online-vnet"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_virtual_network_peering" "corp_to_online" {
  name                      = "corp-to-online-peering"
  resource_group_name       = azurerm_resource_group.example.name
  virtual_network_name      = azurerm_virtual_network.corp_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.online_vnet.id
  allow_virtual_network_access = true
}

resource "azurerm_virtual_network_peering" "online_to_corp" {
  name                      = "online-to-corp-peering"
  resource_group_name       = azurerm_resource_group.example.name
  virtual_network_name      = azurerm_virtual_network.online_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.corp_vnet.id
  allow_virtual_network_access = true
}

Deployment:

Refer:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

https://learn.microsoft.com/en-us/azure/governance/policy

Tutorial: Create a custom policy definition - Azure Policy | Microsoft Learn