azure-frontdoor-endpoint-exposed

id: azure-frontdoor-endpoint-exposed
emits: ExposedToInternet
description: "An enabled Azure Front Door endpoint (*.azurefd.net or a custom domain) is reachable from\
  \ the public internet by design \u2014 AFD uses Microsoft's global anycast infrastructure; no explicit\
  \ public IP is required on the profile. This is derived from the explicit normalization rule azure-frontdoor-endpoint-record."
where:
- Microsoft.Cdn/profiles/{profile}/afdEndpoints/{endpoint} with properties.enabledState == 'Enabled'
- sku.name in ['Standard_AzureFrontDoor', 'Premium_AzureFrontDoor'] (AFD Standard/Premium)
- OR Microsoft.Cdn/profiles/{profile}/endpoints/{endpoint} with properties.isHttpAllowed == true or isHttpsAllowed
  == true (Classic CDN, sku.name in [Standard_Microsoft, Standard_Verizon, Standard_Akamai])
emit:
  source_type: PublicEndpoint
  target_type: AnonymousIdentity
  source: <AFD endpoint node (Microsoft.Cdn/profiles/afdEndpoints or .../endpoints)>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE when properties.enabledState == 'Enabled' (AFD Standard/Premium) or isHttpAllowed/isHttpsAllowed
    == true (Classic CDN), and the endpoint hostname resolves (properties.hostName is present and non-empty).
    CONDITIONAL(network_reachability) if enabledState is unknown from collected data. Do NOT emit for
    endpoints with enabledState == 'Disabled'.
  derived_from:
  - azure-frontdoor-endpoint-record
  false_positive_note: "Verify SKU: Standard_AzureFrontDoor and Premium_AzureFrontDoor are AFD; Standard_Microsoft\
    \ / Standard_Verizon / Standard_Akamai are Classic CDN. Both are internet-exposed but use different\
    \ API paths and have different capabilities (AFD Premium supports Private Link origins; Classic CDN\
    \ does not). A WAF policy linked via securityPolicies does NOT change the public exposure status \u2014\
    \ the endpoint is still internet-reachable; WAF filters traffic but does not privatize the entry point.\
    \ Do NOT emit for disabled endpoints or for AFD origins (origins are backends, not entry points; their\
    \ exposure is separate)."
  narrative: AFD endpoint {source.name} ({source.hostName}) is publicly reachable from the internet via
    Microsoft's anycast CDN network. Any anonymous actor on the internet can send HTTP/S requests to this
    entry point.