azure-batch-dataplane-exposed
Batch account data-plane endpoint reachable by any key/token holder unless restricted to private endpoints.
where
batchAccount publicNetworkAccess == Enabled (no private-endpoint-only restriction)
emit
| source type | * |
|---|---|
| target type | Subscription |
| source | <batchAccount> |
| target | <Subscription> |
| conditions | network_reachability |
Narrative
Batch account {batchAccount.name} exposes its data-plane endpoint (publicNetworkAccess Enabled); any shared-key/token holder can submit tasks.
Raw rule rules/derived/azure/batch.yaml
id: azure-batch-dataplane-exposed
emits: ExposedToAccount
description: Batch account data-plane endpoint reachable by any key/token holder unless restricted to
private endpoints.
where:
- batchAccount publicNetworkAccess == Enabled (no private-endpoint-only restriction)
emit:
source_type: '*'
target_type: Subscription
source: <batchAccount>
target: <Subscription>
conditions:
- network_reachability
false_positive_note: Do not emit if publicNetworkAccess is Disabled or the account is restricted to
private endpoints; reachability then requires an in-VNet foothold (PrivateReachability).
narrative: Batch account {batchAccount.name} exposes its data-plane endpoint (publicNetworkAccess Enabled);
any shared-key/token holder can submit tasks.