armtemplate.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2018-11-01",
      "name": "[parameters('functionAppName')]",
      "location": "[parameters('location')]",
      "kind": "functionapp",
      "properties": {
        "siteConfig": {
          "appSettings": [
            {
              "name": "FUNCTIONS_WORKER_RUNTIME",
              "value": "powershell"
            },
            {
              "name": "VIRUSTOTAL_API_KEY",
              "value": "[parameters('virusTotalApiKey')]"
            },
            {
              "name": "AZURE_SUBSCRIPTION_ID",
              "value": "[parameters('azureSubscriptionId')]"
            }
          ]
        }
      },
      "resources": [
        {
          "type": "functions",
          "apiVersion": "2018-11-01",
          "name": "[parameters('functionName')]",
          "dependsOn": [
            "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]"
          ],
          "properties": {
            "config": {
              "bindings": [
                {
                  "authLevel": "function",
                  "type": "httpTrigger",
                  "direction": "in",
                  "name": "req",
                  "methods": [
                    "get",
                    "post"
                  ]
                },
                {
                  "type": "http",
                  "direction": "out",
                  "name": "res"
                }
              ],
              "script": "using namespace System.Net

param($Request, $TriggerMetadata)

# API Key for VirusTotal
$VirusTotalApiKey = $env:VIRUSTOTAL_API_KEY
# Azure Subscription ID
$SubscriptionId = $env:AZURE_SUBSCRIPTION_ID
# Azure Resource Group Name
$ResourceGroupName = 'sandbox'
# Azure Network Security Group Name
$NSGName = 'williamtest3NSG'

# Extract IP from the request
$RequestBody = $Request | ConvertFrom-Json
$ip = $RequestBody.ip

# Get IP Details from VirusTotal
$VTUrl = "https://www.virustotal.com/api/v3/ip_addresses/$ip"
$headers = @{
    'x-apikey' = $VirusTotalApiKey
}
$response = Invoke-RestMethod -Uri $VTUrl -Headers $headers -Method Get
$country = $response.data.attributes.country
$ipRange = $response.data.attributes.network

if ($country -ne 'USA') {
    # Connect to Azure Account
    Connect-AzAccount -Identity
    
    # Get NSG
    $nsg = Get-AzNetworkSecurityGroup -ResourceGroupName $ResourceGroupName -Name $NSGName
    
    # Check if IP Range is already in NSG
    $exists = $false
    foreach ($rule in $nsg.SecurityRules) {
        if ($rule.DestinationAddressPrefix -eq $ipRange) {
            $exists = $true
            break
        }
    }
    
    if (-not $exists) {
        # Find an available priority
        $priorities = 100..4096 | Where-Object { $_ -notin $nsg.SecurityRules.Priority }
        $priority = $priorities | Select-Object -First 1
        
        # Add IP Range to NSG
        $ruleName = "ip-blocklist" + (Get-Random)
        $newRule = New-AzNetworkSecurityRuleConfig -Name $ruleName -Description "Block $ipRange" -Access Deny -Protocol * -Direction Inbound -Priority $priority -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix $ipRange -DestinationPortRange *
        $nsg.SecurityRules.Add($newRule)
        Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg
    }
}

# Return response
$body = @{
    ipRange = $ipRange
    country = $country
    blocked = (-not $exists)
}
$Response = @{
    StatusCode = [HttpStatusCode]::OK
    ContentType = 'application/json'
    Body = $body | ConvertTo-Json
}
$Response

              "
            }
          }
        }
      ]
    }
  ],
  "parameters": {
    "functionAppName": {
      "type": "string",
      "metadata": {
        "description": "The name of the function app."
      }
    },
    "functionName": {
      "type": "string",
      "metadata": {
        "description": "The name of the function."
      }
    },
    "location": {
      "type": "string",
      "metadata": {
        "description": "The Azure region where the resources will be deployed."
      }
    },
    "virusTotalApiKey": {
      "type": "string",
      "metadata": {
        "description": "The API key for VirusTotal."
      }
    },
    "azureSubscriptionId": {
      "type": "string",
      "metadata": {
        "description": "The subscription ID for Azure."
      }
    }
  }
}