azure-firewall-policy-dnat-rule-record

id: azure-firewall-policy-dnat-rule-record
emits: RoutesTo
applies_to:
- azure
description: Azure Firewall Policy DNAT rule (firewallPolicies/ruleCollectionGroups model) is ingested
  as a synthetic Route node. The route is linked to the internal destination subnet via RoutesTo edge.
  Target is the Firewall that references this policy.
source_config:
  resource_type: Microsoft.Network/firewallPolicies/ruleCollectionGroups
  field: properties.ruleCollections[]
where:
- properties.ruleCollections[].ruleCollectionType == 'FirewallPolicyNatRuleCollection'
- properties.ruleCollections[].action.type == 'Dnat'
- ruleCollection has at least one rule with translatedAddress non-null and non-empty
- translatedAddress is private RFC-1918 IP or resolvable to a Subnet in inventory
emit:
  source_type: Route
  target_type: Subnet
  source: '<synthetic Route node: policy_id + ruleCollectionGroup_name + rule_name>'
  target: <Subnet containing translatedAddress>
  api_source: Microsoft.Network/firewallPolicies/ruleCollectionGroups GET
  evidence_field: ruleCollections[].rules[].destinationAddresses + ruleCollections[].rules[].destinationPorts
    + ruleCollections[].rules[].translatedAddress + ruleCollections[].rules[].translatedPort
  properties:
    source: azure_firewall_policy_dnat
    policy_id: <firewall policy resource id>
    rule_collection_group: <rule collection group name>
    rule_name: <rule name>
    destination_port: <destinationPorts>
    translated_port: <translatedPort>
    translated_address: <translatedAddress>
  narrative: Firewall Policy {policy.name} DNAT rule collection forwards {destinationAddresses}:{destinationPorts}
    -> {translatedAddress}:{translatedPort} to {subnet.name}.