rage.fail

azure-frontdoor-endpoint-record

explicit azure emits ExposedToInternet

where

properties.enabledState == 'Enabled' parent profile sku.name in ['Standard_AzureFrontDoor', 'Premium_AzureFrontDoor']

emit

source type	`PublicEndpoint`
target type	`AnonymousIdentity`
source	`<AFD endpoint node>`
target	`<AnonymousIdentity>`

Narrative

AFD endpoint {endpoint.name} ({endpoint.hostName}) is enabled and publicly reachable.

Raw rule rules/explicit/azure-frontdoor.yaml

id: azure-frontdoor-endpoint-record
emits: ExposedToInternet
applies_to:
- azure
source_config:
  resource_type: Microsoft.Cdn/profiles/afdEndpoints
  field: properties
where:
- properties.enabledState == 'Enabled'
- parent profile sku.name in ['Standard_AzureFrontDoor', 'Premium_AzureFrontDoor']
emit:
  source_type: PublicEndpoint
  target_type: AnonymousIdentity
  source: <AFD endpoint node>
  target: <AnonymousIdentity>
  api_source: Microsoft.Cdn/profiles/afdEndpoints GET
  evidence_field: properties.enabledState + properties.hostName
  narrative: AFD endpoint {endpoint.name} ({endpoint.hostName}) is enabled and publicly reachable.