azure-dns-private-record-write

id: azure-dns-private-record-write
emits: CanModifyConfiguration
description: "Write access to record sets in a private Azure DNS zone (any record type) lets an attacker\
  \ create or overwrite internal hostname records, redirecting resolution for internal service FQDNs (including\
  \ private endpoint hostnames) to attacker-controlled private IPs within the VNet \u2014 enabling internal\
  \ MitM or service impersonation."
match_effective_permission:
  action: Microsoft.Network/privateDnsZones/*/write
  scope_type: resource|resourceGroup|subscription
where:
- effective permission covers Microsoft.Network/privateDnsZones/*/write OR at least one specific record-type
  write
- target is a private DNS zone (Microsoft.Network/privateDnsZones)
- the private zone has at least one active virtualNetworkLink with properties.provisioningState == 'Succeeded'
emit:
  source_type: Identity
  target_type: DNS
  source: <principal>
  target: <private DNS zone>
  permissions:
  - Microsoft.Network/privateDnsZones/*/write
  - Microsoft.Network/privateDnsZones/A/write
  - Microsoft.Network/privateDnsZones/CNAME/write
  state_logic: "ACTIVE when the private zone has at least one active VNet link with properties.provisioningState\
    \ == 'Succeeded' \u2014 the record write immediately affects name resolution within linked VNets.\
    \ Resolution is enabled for every successfully-provisioned link; registrationEnabled is a refinement\
    \ flag (auto-registration of VM records) not a gate on resolution. CONDITIONAL(network_reachability)\
    \ if no active VNet link is confirmed (the zone exists but is not yet linked to any VNet, so no workload\
    \ is currently affected). A deny assignment covering privateDnsZones/*/write -> BLOCKED."
  derived_from:
  - '<effective RBAC record: privateDnsZones/*/write on the zone>'
  - <virtualNetworkLinks ARM record with properties.provisioningState == 'Succeeded'>
  false_positive_note: "A private DNS zone with no VNet links has zero operational impact; do not emit\
    \ ACTIVE. Only emit ACTIVE when at least one virtualNetworkLink exists with properties.provisioningState\
    \ == 'Succeeded'. registrationEnabled is a refinement flag (controls auto-registration of VM records)\
    \ not a gate on resolution; do not use it as the primary condition. Private zone records are NOT internet-resolvable;\
    \ this edge models internal redirection, not internet exposure. The attacker requires a foothold inside\
    \ the VNet or a peered VNet to exploit the redirect \u2014 combine with compute LocatedIn edges for\
    \ full path analysis. Scope: Private DNS Zone Contributor scoped to one zone does not affect sibling\
    \ private zones."
  narrative: '{principal.name} can write DNS record sets in private zone {target.name} (Microsoft.Network/privateDnsZones/*/write).
    The zone is linked to {link_count} VNet(s). Overwriting A or CNAME records redirects internal FQDN
    resolution (including private endpoint hostnames) to attacker-controlled IPs within those VNets, enabling
    internal traffic interception or service impersonation.'