azure-openai-endpoint-public

id: azure-openai-endpoint-public
emits: ExposedToInternet
applies_to:
- azure
match_record:
  resource_type: Microsoft.CognitiveServices/accounts
  field: properties.publicNetworkAccess
where:
- 'properties.publicNetworkAccess == ''Enabled'' or properties.publicNetworkAccess absent  # defaults
  to Enabled'
- 'properties.networkAcls.defaultAction != ''Deny'' or properties.networkAcls absent  # no blanket-deny
  ACL'
- 'properties.privateEndpointConnections empty or absent  # no private-endpoint-only enforcement'
emit:
  source_type: GenericData
  target_type: AnonymousIdentity
  source: <CognitiveServices account node>
  target: <AnonymousIdentity>
  api_source: Microsoft.CognitiveServices/accounts GET (properties.publicNetworkAccess, properties.networkAcls)
  evidence_field: properties.publicNetworkAccess, properties.networkAcls
  state_logic: 'if publicNetworkAccess == ''Enabled'' AND (networkAcls absent OR networkAcls.defaultAction
    != ''Deny'' OR no private-endpoint-only): ACTIVE

    elif publicNetworkAccess == ''Disabled'' OR (networkAcls.defaultAction == ''Deny'' AND privateEndpointConnections
    present): BLOCKED

    elif networkAcls restricts to specific IPs/VNets but not fully private: CONDITIONAL(network_reachability)

    '
  conditions:
  - network_reachability
  false_positive_note: "Do NOT emit when publicNetworkAccess is Disabled or when the account enforces\
    \ private-endpoint-only access (privateEndpointConnections present AND publicNetworkAccess Disabled).\
    \ Also do NOT emit when networkAcls.defaultAction is Deny with no 0.0.0.0/0 allow-rule \u2014 that\
    \ restricts to specific IPs/VNets only, not the open internet. The ExposedToInternet fact describes\
    \ network reachability of the endpoint, not authentication bypass; callers still need a valid API\
    \ key or Entra token."
  narrative: Azure OpenAI account {account.name} exposes its inference endpoint ({account.name}.openai.azure.com)
    to the public internet because publicNetworkAccess is Enabled and networkAcls does not enforce a deny-default
    or private-endpoint-only policy. Any caller holding a valid account key or Entra token can invoke
    model deployments from outside the VNet.