feat(file-shares): Add rule to disable public network access (AZR-000542)

docs/en/rules/Azure.Share.PublicAccess.md

@@ -0,0 +1,85 @@
+---
+reviewed: 2025-11-04
+severity: Critical
+pillar: Security
+category: SE:06 Network controls
+resource: File Shares
+resourceType: Microsoft.Kusto/clusters
+online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Share.PublicAccess/
+---
+
+# Disable public network access on File Shares clusters
+
+## SYNOPSIS
+
+Azure File Shares (Shares) clusters should have public network access disabled.
+
+## DESCRIPTION
+
+Disabling public network access improves security by ensuring that the cluster isn't exposed on the public internet.
+You can control exposure of your clusters by creating private endpoints instead.
+
+## RECOMMENDATION
+
+Consider disabling public network access on Azure File Shares clusters, using private endpoints to control connectivity.
+
+## EXAMPLES
+
+### Configure with Azure template
+
+To deploy File Shares clusters that pass this rule:
+
+- Set the `properties.publicNetworkAccess` property to `Disabled`.
+
+For example:
+
+```json
+{
+  "type": "Microsoft.Kusto/clusters",
+  "apiVersion": "2024-04-13",
+  "name": "[parameters('name')]",
+  "location": "[parameters('location')]",
+  "sku": {
+    "name": "Standard_D11_v2",
+    "tier": "Standard"
+  },
+  "identity": {
+    "type": "SystemAssigned"
+  },
+  "properties": {
+    "publicNetworkAccess": "Disabled"
+  }
+}
+```
+
+### Configure with Bicep
+
+To deploy File Shares clusters that pass this rule:
+
+- Set the `properties.publicNetworkAccess` property to `Disabled`.
+
+For example:
+
+```bicep
+resource adx 'Microsoft.Kusto/clusters@2024-04-13' = {
+  name: name
+  location: location
+  sku: {
+    name: 'Standard_D11_v2'
+    tier: 'Standard'
+  }
+  identity: {
+    type: 'SystemAssigned'
+  }
+  properties: {
+    enableDiskEncryption: true
+    publicNetworkAccess: 'Disabled'
+  }
+}
+```
+
+## LINKS
+
+- [SE:06 Network controls](https://learn.microsoft.com/azure/well-architected/security/networking)
+- [Security: Level 4](https://learn.microsoft.com/azure/well-architected/security/maturity-model?tabs=level4)
+- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters)

src/PSRule.Rules.Azure/rules/Azure.Share.Rule.yaml

@@ -0,0 +1,29 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+#
+# Validation rules for FileShares
+#
+
+#region Rules
+
+---
+# Synopsis: Disable export of artifacts from container registries.
+apiVersion: github.com/microsoft/PSRule/v1
+kind: Rule
+metadata:
+  name: Azure.Share.PublicAccess
+  ref: AZR-000538
+  tags:
+    release: preview
+    ruleSet: 2026_03
+    Azure.WAF/pillar: Security
+
+spec:
+  type:
+    - Microsoft.Kusto/clusters
+  condition:
+    allOf:
+      - field: properties.publicNetworkAccess
+        equals: Disabled
+#endregion Rules

tests/PSRule.Rules.Azure.Tests/Azure.Share.Rule.Tests.ps1

@@ -0,0 +1,60 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+#
+# Unit tests for Azure File Shares rules
+#
+
+[CmdletBinding()]
+param ()
+
+BeforeAll {
+    # Setup error handling
+    $ErrorActionPreference = 'Stop';
+    Set-StrictMode -Version latest;
+
+    if ($Env:SYSTEM_DEBUG -eq 'true')
+    {
+        $VerbosePreference = 'Continue';
+    }
+
+    # Setup tests paths
+    $rootPath = $PWD;
+    Import-Module (Join-Path -Path $rootPath -ChildPath out/modules/PSRule.Rules.Azure) -Force;
+    $here = (Resolve-Path $PSScriptRoot).Path;
+}
+
+Describe 'Azure.Share' -Tag 'Share' {
+    Context 'Conditions' {
+        BeforeAll {
+            $invokeParams = @{
+                Baseline = 'Azure.All'
+                Module = 'PSRule.Rules.Azure'
+                WarningAction = 'Ignore'
+                ErrorAction = 'Stop'
+                Outcome = 'All'
+            }
+            $dataPath = Join-Path -Path $here -ChildPath 'Resources.Share.json';
+            $result = Invoke-PSRule @invokeParams -InputPath $dataPath;
+        }
+
+
+        It 'Azure.Share.PublicAccess' {
+            $filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.Share.PublicAccess' };
+
+            # Fail
+            $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' });
+            $ruleResult | Should -Not -BeNullOrEmpty;
+            $ruleResult.Length | Should -Be 2;
+            $ruleResult.TargetName | Should -Be 'cluster-A', 'cluster-B';
+
+            $ruleResult.Detail.Reason.Path | Should -BeIn 'properties.publicNetworkAccess';
+
+            # Pass
+            $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' });
+            $ruleResult | Should -Not -BeNullOrEmpty;
+            $ruleResult.Length | Should -Be 1;
+            $ruleResult.TargetName | Should -BeIn 'cluster-C';
+        }
+    }
+}