rage.fail

azure-evg-topic-private-endpoint

explicit azure emits HasPolicy

match (record)

{ "field": "properties.privateLinkServiceConnectionState.status", "resource_type": "Microsoft.EventGrid/topics/privateEndpointConnections" }

where

properties.privateLinkServiceConnectionState.status == Approved

emit

source type	`*`
target type	`Policy`
source	`<Event Grid topic>`
target	`<private endpoint connection (GenericPolicy or PrivateEndpoint node)>`

Narrative

Event Grid topic {source.name} has an approved private endpoint connection {target.name}; publish access requires VNet reachability.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-topic-private-endpoint
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/topics/privateEndpointConnections
  field: properties.privateLinkServiceConnectionState.status
where:
- properties.privateLinkServiceConnectionState.status == Approved
emit:
  source_type: '*'
  target_type: Policy
  source: <Event Grid topic>
  target: <private endpoint connection (GenericPolicy or PrivateEndpoint node)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/topics/{topic}/privateEndpointConnections
  evidence_field: properties.privateLinkServiceConnectionState.status
  note: 'An approved private endpoint connection records that the topic restricts publish access to within
    the VNet. This fact feeds the network reachability analysis: if publicNetworkAccess=Disabled AND this
    private endpoint exists, internet-based publish (azure-evg-topic-public) should be BLOCKED; VNet-resident
    attackers remain in scope.'
  narrative: Event Grid topic {source.name} has an approved private endpoint connection {target.name};
    publish access requires VNet reachability.