rage.fail

azure-cosmosdb-network-properties

explicit azure emits HasPolicy

match (record)

{ "field": "properties.publicNetworkAccess", "resource_type": "Microsoft.DocumentDB/databaseAccounts" }

emit

source type	`NoSQLDatabase`
target type	`Policy`
source	`<databaseAccount node>`
target	`<networkAccess ResourcePolicy node>`

Narrative

{account.name} has publicNetworkAccess={properties.publicNetworkAccess}, ipRules={count(properties.ipRules)} entries, virtualNetworkRules={count(properties.virtualNetworkRules)} entries. When publicNetworkAccess=Disabled, only private endpoints can reach the data plane.

Raw rule rules/explicit/azure-cosmosdb.yaml

id: azure-cosmosdb-network-properties
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.DocumentDB/databaseAccounts
  field: properties.publicNetworkAccess
emit:
  source_type: NoSQLDatabase
  target_type: Policy
  source: <databaseAccount node>
  target: <networkAccess ResourcePolicy node>
  api_source: Microsoft.DocumentDB/databaseAccounts GET
  evidence_field: properties.publicNetworkAccess + properties.ipRules + properties.virtualNetworkRules
  narrative: '{account.name} has publicNetworkAccess={properties.publicNetworkAccess}, ipRules={count(properties.ipRules)}
    entries, virtualNetworkRules={count(properties.virtualNetworkRules)} entries. When publicNetworkAccess=Disabled,
    only private endpoints can reach the data plane.'