[BUG] Azure.VNET.UseNGSs is not handling cases correctly when subnets are declared outside the parent

[BenjaminEngeset]

Existing rule

Azure.VNET.UseNGSs

Description of the issue

There is a small subset of special purpose subnets that do not support NSGs. Currently the rule takes this into consideration, however the handling is not working correctly for child resources declared outside the parent resource because the name is then declared as {parent-resource-name}/{child-resource-name}.

I assume PSRule does not handle this when the parent resource is not to be found within the same deployment.

It's a low effort to handle this in the rule body.

PSRule.Rules.Azure/src/PSRule.Rules.Azure/rules/Azure.VNET.Rule.ps1

Lines 10 to 33 in 1a08d69

	# Synopsis: Virtual network (VNET) subnets should have Network Security Groups (NSGs) assigned.
	Rule 'Azure.VNET.UseNSGs' -Ref 'AZR-000263' -Type 'Microsoft.Network/virtualNetworks', 'Microsoft.Network/virtualNetworks/subnets' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; 'Azure.MCSB.v1/control' = 'NS-1' } {
	$excludedSubnets = @('GatewaySubnet', 'AzureFirewallSubnet', 'AzureFirewallManagementSubnet', 'RouteServerSubnet');
	$customExcludedSubnets = $Configuration.GetStringValues('AZURE_VNET_SUBNET_EXCLUDED_FROM_NSG');
	$subnet = @($TargetObject);
	if ($PSRule.TargetType -eq 'Microsoft.Network/virtualNetworks') {
	# Get subnets
	$subnet = @($TargetObject.properties.subnets | Where-Object {
	$_.Name -notin $excludedSubnets -and $_.Name -notin $customExcludedSubnets -and @($_.properties.delegations | Where-Object { $_.properties.serviceName -eq 'Microsoft.HardwareSecurityModules/dedicatedHSMs' }).Length -eq 0
	});
	if ($subnet.Length -eq 0 -or !$Assert.HasFieldValue($TargetObject, 'properties.subnets').Result) {
	return $Assert.Pass();
	}
	}
	elseif ($PSRule.TargetType -eq 'Microsoft.Network/virtualNetworks/subnets' -and
	($PSRule.TargetName -in $excludedSubnets -or $PSRule.TargetName -in $customExcludedSubnets -or @($TargetObject.properties.delegations | Where-Object { $_.properties.serviceName -eq 'Microsoft.HardwareSecurityModules/dedicatedHSMs' }).Length -gt 0)) {
	return $Assert.Pass();
	}
	foreach ($sn in $subnet) {
	$Assert.
	HasFieldValue($sn, 'properties.networkSecurityGroup.id').
	WithReason(($LocalizedData.SubnetNSGNotConfigured -f $sn.Name), $True);
	}
	}

Error messages

No response

Reproduction

{
    "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/vnet-J/subnets/AzureFirewallSubnet",
    "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/vnet-J/subnets/AzureFirewallSubnet",
    "Identity": null,
    "Kind": null,
    "Location": "region",
    "ResourceName": "vnet-J/AzureFirewallSubnet",
    "Name": "vnet-J/AzureFirewallSubnet",
    "Plan": null,
    "Properties": {
      "addressPrefix": "10.7.0.0/26",
      "routeTable": {
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/routeTables/route-A"
      },
      "serviceEndpoints": [],
      "delegations": [],
      "natGateway": {
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/natGateways/gateway-A"
      }
    },
    "ResourceGroupName": "test-rg",
    "Type": "Microsoft.Network/virtualNetworks/subnets",
    "ResourceType": "Microsoft.Network/virtualNetworks/subnets",
    "ExtensionResourceType": null,
    "Sku": null,
    "Tags": null,
    "SubscriptionId": "00000000-0000-0000-0000-000000000000"
  }

Version of PSRule

2.9.0

Version of PSRule for Azure

No response

Additional context

No response