rage.fail

azure-frontdoor-private-link-origin-record

explicit azure emits PrivateReachability

where

properties.sharedPrivateLinkResource is not null properties.enabledState == 'Enabled' parent profile sku.name == 'Premium_AzureFrontDoor'

emit

source type	`Compute`
target type	`PrivateEndpoint`
source	`<Compute resources in the same VNet as the AFD-created private endpoint>`
target	`<private endpoint backing the AFD Private Link origin>`

Narrative

AFD Premium profile {profile.name} reaches {linkedResource.name} via Private Link; compute in the same VNet can reach it privately.

Raw rule rules/explicit/azure-frontdoor.yaml

id: azure-frontdoor-private-link-origin-record
emits: PrivateReachability
applies_to:
- azure
source_config:
  resource_type: Microsoft.Cdn/profiles/originGroups/origins
  field: properties.sharedPrivateLinkResource
where:
- properties.sharedPrivateLinkResource is not null
- properties.enabledState == 'Enabled'
- parent profile sku.name == 'Premium_AzureFrontDoor'
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <Compute resources in the same VNet as the AFD-created private endpoint>
  target: <private endpoint backing the AFD Private Link origin>
  api_source: Microsoft.Cdn/profiles/originGroups/origins GET + target resource privateEndpointConnections
    GET
  evidence_field: properties.sharedPrivateLinkResource.privateLink.id + PE connection status
  narrative: AFD Premium profile {profile.name} reaches {linkedResource.name} via Private Link; compute
    in the same VNet can reach it privately.