请求协助：通过Azure自定义策略禁用多资源IPv6（附失败策略）

一、原有策略失效原因 #

你之前的策略未生效，核心问题是字段名大小写错误：Azure资源属性中，网络接口的IPv6启用字段为enableIPv6（小写v），而你写的是enableIPV6（大写V），导致规则无法匹配目标资源。修正后的网络接口禁用IPv6策略如下：

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/networkInterfaces"
        },
        {
          "field": "Microsoft.Network/networkInterfaces/enableIPv6",
          "equals": true
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

二、四类IPv6禁用场景的对应策略 #

1. 禁用Azure VNet peering的IPv6 #

禁止创建或更新启用IPv6的虚拟网络对等连接：

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings"
        },
        {
          "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/enableIPv6Peering",
          "equals": true
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

2. 禁用私有IPv6配置 #

禁止网络接口配置私有IPv6地址：

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/networkInterfaces"
        },
        {
          "count": {
            "field": "Microsoft.Network/networkInterfaces/ipConfigurations[*]",
            "where": {
              "field": "Microsoft.Network/networkInterfaces/ipConfigurations[*]/privateIPAddressVersion",
              "equals": "IPv6"
            }
          },
          "greaterOrEquals": 1
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

3. 网络层面禁用IPv6（VNet/子网） #

禁用VNet的IPv6地址空间

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/virtualNetworks"
        },
        {
          "count": {
            "field": "Microsoft.Network/virtualNetworks/addressSpace/addressPrefixes[*]",
            "where": {
              "value": "[split(field('Microsoft.Network/virtualNetworks/addressSpace/addressPrefixes[*]'), '/')[0]]",
              "like": "fd*"
            }
          },
          "greaterOrEquals": 1
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

禁用子网的IPv6地址空间

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/virtualNetworks/subnets"
        },
        {
          "count": {
            "field": "Microsoft.Network/virtualNetworks/subnets/addressPrefixes[*]",
            "where": {
              "value": "[split(field('Microsoft.Network/virtualNetworks/subnets/addressPrefixes[*]'), '/')[0]]",
              "like": "fd*"
            }
          },
          "greaterOrEquals": 1
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

4. Compute层面禁用IPv6（VM/VMSS） #

禁用虚拟机的IPv6配置

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "count": {
            "field": "Microsoft.Compute/virtualMachines/networkProfile/networkInterfaces[*]",
            "where": {
              "value": "[reference(field('Microsoft.Compute/virtualMachines/networkProfile/networkInterfaces[*]/id'), '2023-04-01').enableIPv6]",
              "equals": true
            }
          },
          "greaterOrEquals": 1
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

禁用虚拟机规模集的IPv6配置

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachineScaleSets"
        },
        {
          "field": "Microsoft.Compute/virtualMachineScaleSets/networkProfile/networkInterfaceConfigurations[*]/enableIPv6",
          "equals": true
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

内容的提问来源于stack exchange，提问作者Prasanna kumar