azure-evg-topic-public
An Event Grid custom topic with publicNetworkAccess=Enabled is internet-accessible for event publishing (any holder of the topic key can publish from the internet).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?topic) ==
EventBus
?topic.provider_type == 'Microsoft.EventGrid/topics'
?topic.properties.publicNetworkAccess == Enabled
?topic has access keys (keys not disabled via local auth disabled setting)
emit
| source type | EventBus |
|---|---|
| target type | AnonymousIdentity |
| source | ?topic |
| target | <AnonymousIdentity> |
| conditions | service_state |
| state logic | ACTIVE when the topic has publicNetworkAccess=Enabled AND access keys are not disabled (disableLocalAuth property is false or unset). The topic is internet-reachable for any entity holding the key. CONDITIONAL(service_state) if the topic is in a degraded state. BLOCKED if publicNetworkAccess=Disabled — topic is not reachable from the internet regardless of key possession. BLOCKED if disableLocalAuth=true — key-based publish from internet is not possible (Entra-only auth would still be possible for authorized principals). |
Narrative
Event Grid topic {source.name} has publicNetworkAccess=Enabled and key-based authentication; any internet-based party holding the topic access key can publish events and trigger all bound event subscription consumers.
Raw rule rules/derived/azure/eventgrid.yaml
id: azure-evg-topic-public
emits: ExposedToInternet
description: An Event Grid custom topic with publicNetworkAccess=Enabled is internet-accessible for event
publishing (any holder of the topic key can publish from the internet).
match:
- - topic: null
- HasPolicy
- accesspolicy: null
where:
- node_type(?topic) == EventBus
- ?topic.provider_type == 'Microsoft.EventGrid/topics'
- ?topic.properties.publicNetworkAccess == Enabled
- ?topic has access keys (keys not disabled via local auth disabled setting)
emit:
source_type: EventBus
target_type: AnonymousIdentity
source: ?topic
target: <AnonymousIdentity>
permissions: []
conditions:
- service_state
state_logic: "ACTIVE when the topic has publicNetworkAccess=Enabled AND access keys are not disabled\
\ (disableLocalAuth property is false or unset). The topic is internet-reachable for any entity holding\
\ the key. CONDITIONAL(service_state) if the topic is in a degraded state. BLOCKED if publicNetworkAccess=Disabled\
\ \u2014 topic is not reachable from the internet regardless of key possession. BLOCKED if disableLocalAuth=true\
\ \u2014 key-based publish from internet is not possible (Entra-only auth would still be possible\
\ for authorized principals)."
confidence: 0.9
derived_from:
- topic.properties.publicNetworkAccess=Enabled
- topic access keys are enabled (disableLocalAuth is not true)
false_positive_note: "This edge models that the topic PUBLISH SURFACE is internet-accessible, not that\
\ arbitrary anonymous users can publish \u2014 a topic key is still required. The ExposedToInternet\
\ edge expresses the attack entry point (internet reachability) for a key-holding attacker. If disableLocalAuth=true,\
\ Entra-based publish (events/send/action) is still possible from authorized principals \u2014 but\
\ anonymous/key-based internet publish is blocked; in that case do not emit this edge. System topics\
\ are published to by Azure services only (not user-publishable) \u2014 do not emit for systemTopics.\
\ Domain topics inherit internet exposure from their domain's publicNetworkAccess setting."
narrative: Event Grid topic {source.name} has publicNetworkAccess=Enabled and key-based authentication;
any internet-based party holding the topic access key can publish events and trigger all bound event
subscription consumers.