azure-lb-write

id: azure-lb-write
emits: CanModifyConfiguration
description: Writing a Load Balancer resource allows adding a public frontend IP, new load-balancing rules,
  or inbound NAT rules that expose previously private ports.
match_effective_permission:
  action: Microsoft.Network/loadBalancers/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <Microsoft.Network/loadBalancers in scope>
  permissions:
  - Microsoft.Network/loadBalancers/write
  escalation: Promote an internal LB to public by adding a publicIPAddress frontend, or expose additional
    ports via new load-balancing rules, redirecting or widening internet access to backend VMs.
  false_positive_note: 'loadBalancers/write requires PUT/PATCH on the full LB object or sub-resources.
    Confirm the principal does not have a deny assignment covering this operation. Impact varies: adding
    a public frontend to a previously internal LB is high-impact; modifying an existing public LB''s probe
    timeout is low-impact. Scope the narrative to the specific mutation detected in the configuration
    delta.'
  narrative: '{principal.name} can modify load balancer {target.name} (Microsoft.Network/loadBalancers/write),
    including adding a public frontend IP or new load-balancing/NAT rules that expose backend VMs to the
    internet.'