azure-eh-namespace-public

An Event Hubs namespace with no IP/VNet network restrictions and publicNetworkAccess not Disabled is internet-reachable; any holder of SAS or Entra data-plane credentials can access it from the internet.

derived azure emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`GenericMessaging`
target type	`AnonymousIdentity`
source	`?namespace`
target	`<AnonymousIdentity>`
conditions	`service_state`
state logic	ACTIVE when the namespace has publicNetworkAccess not Disabled AND the network rule set defaultAction is Allow (or absent, defaulting to Allow). BLOCKED when publicNetworkAccess=Disabled (private endpoint only). CONDITIONAL(network_ reachability) when VNet rules or IP-filter rules exist that restrict internet access — requires evaluation of the specific source IP/VNet. Note: internet reachability does NOT grant unauthorized access; valid SAS or Entra credentials are still required. This edge models the EXPOSURE SURFACE (reachable from internet + accessible with leaked/brute-forced credentials), not unauthenticated access.

source type

GenericMessaging

target type

AnonymousIdentity

source

?namespace

target

<AnonymousIdentity>

conditions

service_state

state logic

ACTIVE when the namespace has publicNetworkAccess not Disabled AND the network rule set defaultAction is Allow (or absent, defaulting to Allow). BLOCKED when publicNetworkAccess=Disabled (private endpoint only). CONDITIONAL(network_ reachability) when VNet rules or IP-filter rules exist that restrict internet access — requires evaluation of the specific source IP/VNet. Note: internet reachability does NOT grant unauthorized access; valid SAS or Entra credentials are still required. This edge models the EXPOSURE SURFACE (reachable from internet + accessible with leaked/brute-forced credentials), not unauthenticated access.

Narrative

Event Hubs namespace {namespace.name} is internet-reachable (publicNetworkAccess enabled, networkRuleSet.defaultAction=Allow) - any holder of valid SAS keys or Entra data-plane credentials can send or receive events from any internet client without needing a VNet foothold.

Raw rule rules/derived/azure/eventhubs.yaml

id: azure-eh-namespace-public
emits: ExposedToInternet
description: An Event Hubs namespace with no IP/VNet network restrictions and publicNetworkAccess not
  Disabled is internet-reachable; any holder of SAS or Entra data-plane credentials can access it from
  the internet.
match:
- - namespace: null
  - LocatedIn
  - rg: null
where:
- node_class(?namespace) == Messaging
- ?namespace.properties.publicNetworkAccess != 'Disabled'
- ?namespace.properties.networkRuleSet.defaultAction == 'Allow' OR networkRuleSet not present
emit:
  source_type: GenericMessaging
  target_type: AnonymousIdentity
  source: ?namespace
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - service_state
  state_logic: "ACTIVE when the namespace has publicNetworkAccess not Disabled AND the network rule set\
    \ defaultAction is Allow (or absent, defaulting to Allow). BLOCKED when publicNetworkAccess=Disabled\
    \ (private endpoint only). CONDITIONAL(network_ reachability) when VNet rules or IP-filter rules exist\
    \ that restrict internet access \u2014 requires evaluation of the specific source IP/VNet. Note: internet\
    \ reachability does NOT grant unauthorized access; valid SAS or Entra credentials are still required.\
    \ This edge models the EXPOSURE SURFACE (reachable from internet + accessible with leaked/brute-forced\
    \ credentials), not unauthenticated access."
  confidence: 0.88
  derived_from:
  - 'namespace properties: publicNetworkAccess!=Disabled + networkRuleSet.defaultAction=Allow'
  false_positive_note: "Event Hubs always requires authentication (SAS or Entra) regardless of network\
    \ openness \u2014 there is no anonymous/public unauthenticated access mode. This edge models that\
    \ the ENDPOINT IS INTERNET-REACHABLE, not that it is exploitable without credentials. The value is:\
    \ an attacker who has stolen SAS keys (listkeys) or Entra credentials can use them from any internet\
    \ location. If IP-filter or VNet service endpoint rules deny the attacker's source IP, downgrade to\
    \ CONDITIONAL(network_reachability). If publicNetworkAccess=Disabled, emit as BLOCKED \u2014 the internet-facing\
    \ endpoint is completely closed."
  narrative: "Event Hubs namespace {namespace.name} is internet-reachable (publicNetworkAccess enabled,\
    \ networkRuleSet.defaultAction=Allow) \u2014 any holder of valid SAS keys or Entra data-plane credentials\
    \ can send or receive events from any internet client without needing a VNet foothold."