azure-appgw-public-frontend-exposed

id: azure-appgw-public-frontend-exposed
emits: ExposedToInternet
description: An Application Gateway with a public frontend IP accepts HTTP/HTTPS traffic from the internet
  on its listener ports.
where:
- frontendIPConfigurations[*].publicIPAddress is non-null (allocated public IP)
- at least one httpListener references the public frontendIPConfiguration
emit:
  source_type: LoadBalancer
  target_type: AnonymousIdentity
  source: <Microsoft.Network/applicationGateways with public frontend>
  target: <AnonymousIdentity>
  permissions: []
  state_logic: "ACTIVE when the public frontend IP is allocated and a listener is configured. Application\
    \ Gateway does not have the closed-by-default restriction of Standard LB; listener ports (80, 443)\
    \ are open to the internet once the frontend is public. WAF (if present in Prevention mode) filters\
    \ L7 attacks but does not block the network-level exposure \u2014 emit ExposedToInternet regardless\
    \ of WAF state."
  false_positive_note: "An internal Application Gateway (all frontendIPConfigurations reference only privateIPAddress,\
    \ no publicIPAddress) is NOT internet-exposed \u2014 do not emit. WAF presence in Prevention mode\
    \ reduces L7 exploitability but does NOT change the ExposedToInternet fact; note WAF presence in the\
    \ narrative. A stopped Application Gateway (powerState == Stopped) is not actively routing; emit CONDITIONAL(service_state)\
    \ if the gateway is stopped."
  narrative: Application Gateway {source.name} has a public frontend IP; the internet can reach its listeners
    on the configured ports (typically 80/443). WAF (if attached in Prevention mode) filters L7 attacks
    but the gateway frontend is internet-reachable.