azure-lb-public-frontend-exposed

id: azure-lb-public-frontend-exposed
emits: ExposedToInternet
description: A Standard Load Balancer with a public frontend IP is reachable from the internet on its
  listener ports.
where:
- frontendIPConfigurations[*].publicIPAddress is non-null (allocated public IP)
- at least one loadBalancingRule or inboundNatRule references the public frontend
emit:
  source_type: LoadBalancer
  target_type: AnonymousIdentity
  source: <Microsoft.Network/loadBalancers with public frontend>
  target: <AnonymousIdentity>
  permissions: []
  state_logic: 'ACTIVE: the LB frontend itself is internet-reachable by definition (the public IP is allocated
    and has a listener). Backend VM reachability is CONDITIONAL(network_reachability) in downstream rules
    because Standard LB is closed by default; the backend subnet/NIC NSG must explicitly allow the port.
    The ExposedToInternet edge on the LB itself is ACTIVE (no condition). Backend exposure conditions
    are handled by the network-chains linchpin when composing transitive paths (LB -> NSG -> VM reach).'
  false_positive_note: "Standard Load Balancer is closed-to-inbound by default. A public frontend IP alone\
    \ is necessary but not sufficient for backends to be reachable: the effective NSG on the backend subnet\
    \ or NIC must have an ALLOW rule for the port. This rule emits ExposedToInternet on the LB as ACTIVE\
    \ (the IP is internet-reachable). Backend VM reachability is conditional and composed by the network-chains\
    \ linchpin. An internal LB (frontendIPConfigurations[*].privateIPAddress only, no publicIPAddress)\
    \ is NOT internet-exposed \u2014 do not emit this rule."
  narrative: Load balancer {source.name} has a public frontend IP; internet hosts can send traffic to
    its listener ports. Backend VM reachability depends on the effective NSG on the backend subnet or
    NIC.