Force Service Endpoint Policy if service endpoint is enabled

Continuing the Service Endpoint Policy Improvement series with an Azure Policy: this time, I want to enforce that whenever users enable a Storage Account service endpoint on a subnet, they must also attach the corresponding service endpoint policy.

With this solution, we not only prevent users from forgetting this important security setting, but we also gain compliance reporting on subnets with service endpoints.

A quick and simple solution once again—powered by Azure Policy ;)

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/virtualNetworks/subnets"
        },
        {
          "count": {
            "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpoints[*]",
            "where": {
              "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpoints[*].service",
              "like": "Microsoft.Storage*"
            }
          },
          "greater": 0
        },
        {
          "count": {
            "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpointPolicies[*]",
            "where": {
              "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpointPolicies[*].id",
              "exists": true
            }
          },
          "notEquals": 1
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}