Optimize Powershell script for Azure NSG - azure

Question

I have a script for finding all inbound, allow rules in Azure NSG which source is any. It is doing his job but it takes just an enormous amount of time to iterate every rule in every available NSG in Azure.
Question is there is any way to optimize it, so it could work faster? Thanks!
function nsg {
# List of default rules which are skipped
$array =
'Default rules'
# Get all RG with NSG
$RGS = (Get-AzureRmResource -ODataQuery "`$filter=resourcetype eq 'Microsoft.Network/networkSecurityGroups'").ResourceGroupName | Sort-Object -Unique
foreach ($RG in $RGS) {
# List of all NSG names
$NSG_Names = (Get-AzureRmNetworkSecurityGroup -ResourceGroupName $RG).Name
# Get NSG rules
foreach ($NSG_Name in $NSG_Names){
$Rules = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig | Select-Object -ExpandProperty Name
# Check if rule is not default
foreach ($Rule in $Rules){
if ($array.contains($Rule)){
Write-Verbose "$Rule excluded because it is default!"
}
else {
Write-Verbose "$NSG_Name - $Rule"
#$DestinationAddressPrefix = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig -Name $Rule | Select-Object -ExpandProperty DestinationAddressPrefix
$DestinationPortRange = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig -Name $Rule | Select-Object -ExpandProperty DestinationPortRange
$SourceAddrPref = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig -Name $Rule | Select-Object -ExpandProperty SourceAddressPrefix
$SourcePortRange = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig -Name $Rule | Select-Object -ExpandProperty SourcePortRange
$Access = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig -Name $Rule | Select-Object -ExpandProperty Access
$Direction = Get-AzureRmNetworkSecurityGroup -Name $NSG_Name -ResourceGroupName $RG | Get-AzureRmNetworkSecurityRuleConfig -Name $Rule | Select-Object -ExpandProperty Direction
# Chek rule for every criterion, access type, etc.
if ($Direction -eq "Inbound" -and $SourceAddrPref -eq "*" -and $Access -eq "Allow"){ #-and $DestinationAddressPrefix -eq "*" -and $DestinationPortRange -eq "*") {
$message = "Warning! RG: $RG; NSG: $NSG_Name has SOURCE ANY Rule: $Rule to Destionation Port: $DestinationPortRange"
$message
}}}}}}

Answer 1

I don't think you need to iterate all that data. All those nested loops + sorting is whats causing the slowdown.
It seems to me that you just want to output all your NSGs with direction Inbound and access is Allow and source address prefix as *. If this is the case, you can do this:
$nsgs = Get-AzureRmNetworkSecurityGroup
foreach ($nsg in $nsgs.SecurityRules)
{
if ($nsg.Direction -eq "Inbound" -and $nsg.Access -eq "Allow" -and $nsg.SourceAddressPrefix -eq "*")
{
$nsg
}
}
Here we just iterate the security rules you have made from $nsgs.SecurityRules. The default ones are in $nsgs.DefaultSecurityRules. You can pipe to Get-Member to find these properties.