azure-frontdoor-private-link-origin

An AFD Premium origin configured with a sharedPrivateLinkResource makes the target PaaS service reachable via a private endpoint inside the customer VNet. A compute foothold in the same VNet as the PE subnet can reach the same service privately (without traversing the internet).

derived azure emits PrivateReachability

where

Microsoft.Cdn/profiles sku.name == 'Premium_AzureFrontDoor' origin properties.sharedPrivateLinkResource is not null origin properties.sharedPrivateLinkResource.requestMessage is present (PE request submitted) the Private Endpoint connection on the target resource has status == 'Approved' origin properties.enabledState == 'Enabled'

emit

source type	`Compute`
target type	`PrivateEndpoint`
source	`<any Compute resource located in the same VNet as the AFD-created private endpoint subnet>`
target	`<private endpoint backing the AFD origin (linked resource: App Service, Storage, APIM, etc.)>`
conditions	`network_reachability`
state logic	CONDITIONAL(network_reachability): the private endpoint exists and the PE connection is Approved, but actual reachability from a specific Compute source requires that source to be in the same VNet (or a Connected peered VNet with allowVirtualNetworkAccess=true) as the PE subnet, with no NSG blocking it. Emit ACTIVE only when the source is confirmed to be in the same subnet or VNet as the PE. Do NOT emit if the PE connection status is 'Pending' or 'Rejected' — the AFD PL origin is not active until the resource owner Approves the PE connection.

Narrative

AFD Premium profile {afdProfile.name} routes traffic to a Private Link-backed origin ({target.name}) inside VNet {vnet.name}. A compute resource in that VNet can reach the same private service ({linkedService.name}) without traversing the internet, via the AFD-created private endpoint.

Raw rule rules/derived/azure/frontdoor.yaml

id: azure-frontdoor-private-link-origin
emits: PrivateReachability
description: An AFD Premium origin configured with a sharedPrivateLinkResource makes the target PaaS service
  reachable via a private endpoint inside the customer VNet. A compute foothold in the same VNet as the
  PE subnet can reach the same service privately (without traversing the internet).
where:
- Microsoft.Cdn/profiles sku.name == 'Premium_AzureFrontDoor'
- origin properties.sharedPrivateLinkResource is not null
- origin properties.sharedPrivateLinkResource.requestMessage is present (PE request submitted)
- the Private Endpoint connection on the target resource has status == 'Approved'
- origin properties.enabledState == 'Enabled'
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <any Compute resource located in the same VNet as the AFD-created private endpoint subnet>
  target: '<private endpoint backing the AFD origin (linked resource: App Service, Storage, APIM, etc.)>'
  permissions: []
  conditions:
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability): the private endpoint exists and the PE connection is\
    \ Approved, but actual reachability from a specific Compute source requires that source to be in the\
    \ same VNet (or a Connected peered VNet with allowVirtualNetworkAccess=true) as the PE subnet, with\
    \ no NSG blocking it. Emit ACTIVE only when the source is confirmed to be in the same subnet or VNet\
    \ as the PE. Do NOT emit if the PE connection status is 'Pending' or 'Rejected' \u2014 the AFD PL\
    \ origin is not active until the resource owner Approves the PE connection."
  derived_from:
  - '<AFD origin ARM record: properties.sharedPrivateLinkResource>'
  - '<target resource private endpoint connection: properties.privateLinkServiceConnectionState.status
    == Approved>'
  false_positive_note: "AFD Premium Private Link origin is ONLY available on Premium_AzureFrontDoor SKU.\
    \ Do NOT emit for Standard_AzureFrontDoor, Standard_Microsoft, Standard_Verizon, or Standard_Akamai\
    \ profiles. The PE connection approval must be verified on the TARGET resource (e.g., Microsoft.Web/sites/privateEndpointConnections\
    \ or Microsoft.Storage/storageAccounts/privateEndpointConnections) \u2014 the AFD ARM record alone\
    \ does not confirm approval; confirm via a separate ARM GET on the linked resource. A 'Pending' PE\
    \ connection means no traffic flows (AFD holds traffic in queue or returns 502). PrivateReachability\
    \ gates network access only; the PaaS resource's own auth (RBAC, SAS, app auth) is still required\
    \ for data-plane access."
  narrative: AFD Premium profile {afdProfile.name} routes traffic to a Private Link-backed origin ({target.name})
    inside VNet {vnet.name}. A compute resource in that VNet can reach the same private service ({linkedService.name})
    without traversing the internet, via the AFD-created private endpoint.