{
    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.Network/networkSecurityGroups/securityRules"
            },
            {
                "allOf": [
                    {
                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
                        "equals": "Allow"
                    },
                    {
                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
                        "equals": "Inbound"
                    },
                    {
                        "anyOf": [
                            {
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                                "equals": "*"
                            },
                            {
                                "not": {
                                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                                    "notEquals": "*"
                                }
                            }
                        ]
                    },
                    {
                        "anyOf": [
                            {
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
                                "in": [
                                    "*",
                                    "Internet"
                                ]
                            },
                            {
                                "not": {
                                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefixes[*]",
                                    "notIn": [
                                        "*",
                                        "Internet"
                                    ]
                                }
                            }
                        ]
                    }
                ]
            }
        ]
    },
    "then": {
        "effect": "deny"
    }
}