azure-appsvc-exposed-internet
App Service site reachable from the public internet on its default/custom hostname or scm endpoint.
where
site properties.publicNetworkAccess != 'Disabled'
no access restriction / private-endpoint-only rule denies the public source
emit
| target type | AnonymousIdentity |
|---|---|
| source | <Microsoft.Web/sites> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{site.name} is reachable from the internet (public network access enabled, no restrictive access rules).
Raw rule rules/derived/azure/appservice.yaml
id: azure-appsvc-exposed-internet
emits: ExposedToInternet
description: App Service site reachable from the public internet on its default/custom hostname or scm
endpoint.
where:
- site properties.publicNetworkAccess != 'Disabled'
- no access restriction / private-endpoint-only rule denies the public source
emit:
target_type: AnonymousIdentity
source: <Microsoft.Web/sites>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Do NOT emit if publicNetworkAccess=Disabled, a private endpoint replaces public
access, or IP access restrictions deny the source. Public-by-default is common but not guaranteed.
The scm (Kudu) endpoint may have separate restrictions.
narrative: '{site.name} is reachable from the internet (public network access enabled, no restrictive
access rules).'