azure-aci-exposed-internet
Container group with a public IP and exposed ports.
where
containerGroup ipAddress.type == Public
ipAddress.ports lists a reachable port (e.g. app/80/443)
emit
| target type | AnonymousIdentity |
|---|---|
| source | <containerGroup> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{group.name} is reachable from the internet on an exposed port (public IP).
Raw rule rules/derived/azure/aci.yaml
id: azure-aci-exposed-internet
emits: ExposedToInternet
description: Container group with a public IP and exposed ports.
where:
- containerGroup ipAddress.type == Public
- ipAddress.ports lists a reachable port (e.g. app/80/443)
emit:
target_type: AnonymousIdentity
source: <containerGroup>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Do not emit for VNet-injected groups (ipAddress.type Private / subnetIds set) or
when no ports are exposed. A public IP with no listening/exposed port is not exposure.
narrative: '{group.name} is reachable from the internet on an exposed port (public IP).'