Feature Request - combination Deny vNet peering cross subscription & Deny-VNET-Peering-To-Non-Approved-VNETs

[timmoh]

szenario:

• HubToSpoke Peering done by: Deny-VNET-Peering-To-Non-Approved-VNETs => fine
• subscription intneral peering: Deny vNet peering cross subscription => fine

but if we've got an HubToSpoke Subscription with internal vnet peering. This won't work with these to Policy.

Suggestion:

• Option A) Deny-VNET-Peering-To-Non-Approved-VNETs

  • add an option to allow inner subscription peering

• Option B) Deny vNet peering cross subscription

  • add an excludelist of vnet ids which are ok to do cross subscriptions

or both ;-)

[Springstone]

Tracking in AB#35840

[Springstone]

https://github.com/Azure/Enterprise-Scale/pull/1731

[Springstone]

This is complete and has been merged.