azure-firewall-dnat-exposure
When an Azure Firewall has active DNAT rules and a public IP allocated, resources translated by those rules are exposed to the internet via the firewall's public endpoint. This is emitted as internet exposure on the firewall node itself (as a Network class that has public reachability).
match (effective permission)
{
"action": "EXISTS natRuleCollections[].rules[].action.type == \u0027Dnat\u0027 OR EXISTS firewallPolicy AND linked_policy_has DNAT_rules",
"scope_type": "resource"
}
emit
| source type | Network |
|---|---|
| target type | AnonymousIdentity |
| source | <Azure Firewall with active DNAT and public IP allocated> |
| target | <AnonymousIdentity> |
| conditions | network_reachability service_state |
| state logic | ACTIVE when: firewall provisioningState == Succeeded AND a public IP is allocated in ipConfigurations AND the firewall/policy has at least one active DNAT rule with valid translatedAddress. CONDITIONAL(service_state) if firewall is Deallocated (no public IP allocated). CONDITIONAL(network_reachability) if the firewall itself is not internet-reachable (e.g., isolated in a private network, though that would defeat the purpose of public IP allocation). |
Narrative
Azure Firewall {source.name} has active DNAT rules translating traffic from its public endpoint, exposing internal resources to the internet.
Raw rule rules/derived/azure/firewall.yaml
id: azure-firewall-dnat-exposure
emits: ExposedToInternet
description: When an Azure Firewall has active DNAT rules and a public IP allocated, resources translated
by those rules are exposed to the internet via the firewall's public endpoint. This is emitted as internet
exposure on the firewall node itself (as a Network class that has public reachability).
match_effective_permission:
action: EXISTS natRuleCollections[].rules[].action.type == 'Dnat' OR EXISTS firewallPolicy AND linked_policy_has
DNAT_rules
scope_type: resource
emit:
source_type: Network
target_type: AnonymousIdentity
source: <Azure Firewall with active DNAT and public IP allocated>
target: <AnonymousIdentity>
permissions: []
conditions:
- network_reachability
- service_state
state_logic: 'ACTIVE when: firewall provisioningState == Succeeded AND a public IP is allocated in ipConfigurations
AND the firewall/policy has at least one active DNAT rule with valid translatedAddress. CONDITIONAL(service_state)
if firewall is Deallocated (no public IP allocated). CONDITIONAL(network_reachability) if the firewall
itself is not internet-reachable (e.g., isolated in a private network, though that would defeat the
purpose of public IP allocation).'
false_positive_note: DNAT rules without valid translatedAddress (null or malformed) are not genuine
exposure. Deallocated firewalls cannot process DNAT. Verify via the explicit DNAT normalization rules
that a RoutesTo edge exists (proof of active rule + public IP + resolved destination).
narrative: Azure Firewall {source.name} has active DNAT rules translating traffic from its public endpoint,
exposing internal resources to the internet.
derived_from:
- iam:firewall_dnat_config({source})