azure-lb-nat-rule-write

id: azure-lb-nat-rule-write
emits: CanModifyConfiguration
description: Creating or modifying an inbound NAT rule maps a public LB frontend port directly to a backend
  VM's port, potentially exposing SSH/RDP/admin ports to the internet.
match_effective_permission:
  action: Microsoft.Network/loadBalancers/inboundNatRules/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <Microsoft.Network/loadBalancers in scope>
  permissions:
  - Microsoft.Network/loadBalancers/inboundNatRules/write
  escalation: 'Create NAT rule: frontend public IP port N -> backend VM port 22 (SSH) or 3389 (RDP), exposing
    the VM''s management interface to the internet without changing the NSG (if the NSG was already allowing
    traffic via the LB).'
  false_positive_note: An inbound NAT rule on a public LB can expose a specific backend VM port. This
    only creates internet exposure if the LB already has a public frontend IP (see azure-lb-public-frontend-exposed);
    on an internal LB, this expands within-VNet reach, not internet exposure. Also requires the backend
    NSG to allow the traffic. Emit CONDITIONAL(network_reachability) if NSG is not confirmed permissive.
  narrative: '{principal.name} can create or modify inbound NAT rules on load balancer {target.name} (inboundNatRules/write),
    directly mapping a public frontend port to a backend VM''s service port (e.g., SSH/RDP), potentially
    exposing management interfaces to the internet.'