azure-firewall-dnat-exposure

When an Azure Firewall has active DNAT rules and a public IP allocated, resources translated by those rules are exposed to the internet via the firewall's public endpoint. This is emitted as internet exposure on the firewall node itself (as a Network class that has public reachability).

derived azure emits ExposedToInternet

match (effective permission)

{ "action": "EXISTS natRuleCollections[].rules[].action.type == \u0027Dnat\u0027 OR EXISTS firewallPolicy AND linked_policy_has DNAT_rules", "scope_type": "resource" }

emit

source typeNetwork
target typeAnonymousIdentity
source<Azure Firewall with active DNAT and public IP allocated>
target<AnonymousIdentity>
conditionsnetwork_reachability service_state
state logicACTIVE when: firewall provisioningState == Succeeded AND a public IP is allocated in ipConfigurations AND the firewall/policy has at least one active DNAT rule with valid translatedAddress. CONDITIONAL(service_state) if firewall is Deallocated (no public IP allocated). CONDITIONAL(network_reachability) if the firewall itself is not internet-reachable (e.g., isolated in a private network, though that would defeat the purpose of public IP allocation).

Narrative

Azure Firewall {source.name} has active DNAT rules translating traffic from its public endpoint, exposing internal resources to the internet.

Raw rule rules/derived/azure/firewall.yaml

id: azure-firewall-dnat-exposure
emits: ExposedToInternet
description: When an Azure Firewall has active DNAT rules and a public IP allocated, resources translated
  by those rules are exposed to the internet via the firewall's public endpoint. This is emitted as internet
  exposure on the firewall node itself (as a Network class that has public reachability).
match_effective_permission:
  action: EXISTS natRuleCollections[].rules[].action.type == 'Dnat' OR EXISTS firewallPolicy AND linked_policy_has
    DNAT_rules
  scope_type: resource
emit:
  source_type: Network
  target_type: AnonymousIdentity
  source: <Azure Firewall with active DNAT and public IP allocated>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  - service_state
  state_logic: 'ACTIVE when: firewall provisioningState == Succeeded AND a public IP is allocated in ipConfigurations
    AND the firewall/policy has at least one active DNAT rule with valid translatedAddress. CONDITIONAL(service_state)
    if firewall is Deallocated (no public IP allocated). CONDITIONAL(network_reachability) if the firewall
    itself is not internet-reachable (e.g., isolated in a private network, though that would defeat the
    purpose of public IP allocation).'
  false_positive_note: DNAT rules without valid translatedAddress (null or malformed) are not genuine
    exposure. Deallocated firewalls cannot process DNAT. Verify via the explicit DNAT normalization rules
    that a RoutesTo edge exists (proof of active rule + public IP + resolved destination).
  narrative: Azure Firewall {source.name} has active DNAT rules translating traffic from its public endpoint,
    exposing internal resources to the internet.
  derived_from:
  - iam:firewall_dnat_config({source})
move · open · esc close