azure-netapp-invnet-volume-read

id: azure-netapp-invnet-volume-read
emits: CanReadData
description: In-VNet network access to ANF volume enables NFS/SMB data-plane read (ARM volumes/read is
  metadata-only prerequisite).
match:
- - principal: null
  - HasPermission
  - volume: null
where:
- node_class(?volume) == Storage and node_type(?volume) == FileStorage
- ?volume.provider_type == 'Microsoft.NetApp/netAppAccounts/capacityPools/volumes'
- ?principal has EFFECTIVE Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read at ?volume scope
  (Owner, Contributor, Reader, or custom role with volumes/read)
- '?volume.properties.provisioningState == ''Succeeded''  # volume is online'
emit:
  source_type: Identity
  target_type: FileStorage
  source: ?principal
  target: ?volume
  permissions:
  - Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read
  conditions:
  - iam_permission
  - network_reachability
  - resource_policy
  state_logic: "CONDITIONAL(network_reachability, resource_policy) \u2014 regardless of export policy\
    \ visibility. Network reachability to the delegated subnet is required and unknowable statically.\
    \ NFS export policy IP matching cannot be evaluated at collection time without runtime foothold IP\
    \ knowledge; SMB NTFS ACL evaluation requires AD group membership resolution. A deny assignment on\
    \ volumes/read blocks ARM metadata visibility but DOES NOT block data-plane NFS/SMB mount (export\
    \ policy is the authoritative data-plane control). Maximum state: CONDITIONAL, never ACTIVE."
  confidence: '0.75'
  derived_from:
  - ?principal HasPermission ?volume
  false_positive_note: "ARM volumes/read grants METADATA only (volume properties, mount target IP, export\
    \ policy configuration). Data-plane access (file read/write) REQUIRES: (a) network reachability to\
    \ the volume's delegated subnet (no public endpoint; must be same VNet, peered VNet, or VPN-connected);\
    \ (b) NFS export policy allowing the caller's source IP (NFS v3/v4.1), or NTFS ACL / AD group membership\
    \ (SMB). This edge remains CONDITIONAL(network_reachability, resource_policy) because export policy\
    \ IP matching is NOT evaluable statically \u2014 the attacker's foothold IP at mount time is unknown\
    \ at collection time. Do NOT emit ACTIVE branches; do NOT emit ExposedToInternet \u2014 ANF has no\
    \ public endpoint by platform design. A deny assignment on volumes/read blocks ARM metadata access\
    \ but DOES NOT block data-plane NFS/SMB mount (export policy is the authoritative data-plane control).\
    \ Therefore, do NOT emit BLOCKED on this edge when a deny assignment covers volumes/read; instead\
    \ emit CONDITIONAL(network_reachability) to reflect that data-plane access is still possible via export\
    \ policy, independent of ARM RBAC."
  narrative: '{principal.name} has ARM read permission on ANF volume {volume.name}. To mount and read
    file data, {principal.name} requires network access to the volume''s delegated subnet. The NFS export
    policy IP allow-list or SMB NTFS ACLs and AD group membership govern the effective read scope (independent
    of ARM RBAC).'