rage.fail

azure-evg-topic-network-access-policy

explicit azure emits HasPolicy

match (record)

{ "field": "properties.publicNetworkAccess", "resource_type": "Microsoft.EventGrid/topics" }

emit

source type	`*`
target type	`Policy`
source	`<Event Grid topic>`
target	`<network access policy (GenericPolicy node)>`

Narrative

Event Grid topic {source.name} has publicNetworkAccess={value}; Disabled blocks internet-based event publishing.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-topic-network-access-policy
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/topics
  field: properties.publicNetworkAccess
emit:
  source_type: '*'
  target_type: Policy
  source: <Event Grid topic>
  target: <network access policy (GenericPolicy node)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/topics/{topic}
  evidence_field: properties.publicNetworkAccess (Enabled | Disabled)
  note: "Feeds azure-evg-topic-public (ExposedToInternet) in derived rules: publicNetworkAccess=Enabled\
    \ \u2192 the topic is internet-reachable for publishing (ACTIVE if keys not disabled); publicNetworkAccess=Disabled\
    \ \u2192 internet publishing BLOCKED. Also feeds azure-evg-publish-via-key CONDITIONAL(network_reachability)\
    \ gate."
  narrative: Event Grid topic {source.name} has publicNetworkAccess={value}; Disabled blocks internet-based
    event publishing.