{
    "properties": {
        "displayName": "Denies NSG rule changes that allow all inbound traffic",
        "description": "Denies the creation of network security group rules that allow all inbound traffic",
        "mode": "All",
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Network/networkSecurityGroups/securityRules"
                    },
                    {
                        "allOf": [
                            {
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
                                "equals": "Allow"
                            },
                            {
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
                                "equals": "Inbound"
                            },
                            {
                                "anyOf": [
                                    {
                                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                                        "equals": "*"
                                    },
                                    {
                                        "not": {
                                            "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                                            "notEquals": "*"
                                        }
                                    }
                                ]
                            },
                            {
                                "anyOf": [
                                    {
                                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
                                        "in": [
                                            "*",
                                            "Internet"
                                        ]
                                    },
                                    {
                                        "not": {
                                            "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefixes[*]",
                                            "notIn": [
                                                "*",
                                                "Internet"
                                            ]
                                        }
                                    }
                                ]
                            }
                        ]
                    }
                ]
            },
            "then": {
                "effect": "deny"
            }
        }
    }
}
