azure-containerapps-exposed-internet
Container App with external ingress and no denying IP restrictions.
where
configuration.ingress.external == true
no configuration.ingress.ipSecurityRestrictions denies the caller (or none set)
the managed environment is not internal-only
emit
| target type | AnonymousIdentity |
|---|---|
| source | <containerApp> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{app.name} is reachable from the internet on its ingress targetPort (external ingress, no denying IP restrictions).
Raw rule rules/derived/azure/containerapps.yaml
id: azure-containerapps-exposed-internet
emits: ExposedToInternet
description: Container App with external ingress and no denying IP restrictions.
where:
- configuration.ingress.external == true
- no configuration.ingress.ipSecurityRestrictions denies the caller (or none set)
- the managed environment is not internal-only
emit:
target_type: AnonymousIdentity
source: <containerApp>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Do not emit if ingress.external is false/absent, the environment is internal-only,
or ipSecurityRestrictions deny by default. Internal ingress is reachable only in-VNet -> use PrivateReachability
instead.
narrative: '{app.name} is reachable from the internet on its ingress targetPort (external ingress, no
denying IP restrictions).'