TerraformAzureInsecureNSGPorts.rego

# List of insecure ports
disallowedPorts = {"22", "80", "3389"}

deny[msg] {
  # loop through the resources and find all the network security groups.
  # Get all their security rules and destination ports
  resourcePorts := {p | c = input.resource_changes[_]; 
                        p = c.change.after.security_rule[_].destination_port_range}
  
  # Find any resource ports that match a port on the disallowed list
  badPorts := {b | b = resourcePorts[_]; disallowedPorts[b]}
  
  # Return a list of bad ports to the user
  msg := sprintf("The following insecure ports open: %v", [badPorts])
}