azure-pl-approve-connection

Write access to a PaaS resource's privateEndpointConnections lets an attacker approve a PE connection from an attacker-controlled VNet, granting that VNet private network access to the resource - bypassing its public firewall.

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": "\u003cresource-type\u003e/privateEndpointConnections/write", "scope_type": "resource|resourceGroup|subscription" }

where

Effective permission is one of: Microsoft.KeyVault/vaults/privateEndpointConnections/write, Microsoft.Storage/storageAccounts/privateEndpointConnections/write, Microsoft.Sql/servers/privateEndpointConnections/write, Microsoft.ServiceBus/namespaces/privateEndpointConnections/write, Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write, Microsoft.Cache/redis/privateEndpointConnections/write, Microsoft.ContainerRegistry/registries/privateEndpointConnections/write, Microsoft.CognitiveServices/accounts/privateEndpointConnections/write, Microsoft.Search/searchServices/privateEndpointConnections/write, or any resource-type equivalent included via Contributor / Owner.

emit

source type	`Identity`
target type	`Data`
source	`<principal>`
target	`<PaaS resource (Key Vault / Storage / SQL / etc.) that owns the PE connection>`
permissions	`Microsoft.KeyVault/vaults/privateEndpointConnections/write` `Microsoft.Storage/storageAccounts/privateEndpointConnections/write` `Microsoft.Sql/servers/privateEndpointConnections/write` `Microsoft.ServiceBus/namespaces/privateEndpointConnections/write` `Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write` `Microsoft.Cache/redis/privateEndpointConnections/write` `Microsoft.ContainerRegistry/registries/privateEndpointConnections/write` `Microsoft.CognitiveServices/accounts/privateEndpointConnections/write` `Microsoft.Search/searchServices/privateEndpointConnections/write`
state logic	ACTIVE: the principal can immediately approve any pending PE connection on the resource. The capability is realized at approval time; a Pending PE from an attacker VNet may or may not exist yet. If only Pending connections exist in an attacker-controlled subscription: ACTIVE (attacker creates PE + approves). If no Pending connections exist: POTENTIAL (attacker must first create a PE in a VNet they control, then approve it using this permission).

Narrative

{principal.name} can approve private endpoint connection requests on {target.name} (privateEndpointConnections/write). Approving a PE from an attacker-controlled VNet grants that VNet private network access to {target.name}, bypassing its public firewall.

Raw rule rules/derived/azure/privatelink.yaml

id: azure-pl-approve-connection
emits: CanModifyConfiguration
description: "Write access to a PaaS resource's privateEndpointConnections lets an attacker approve a\
  \ PE connection from an attacker-controlled VNet, granting that VNet private network access to the resource\
  \ \u2014 bypassing its public firewall."
match_effective_permission:
  action: <resource-type>/privateEndpointConnections/write
  scope_type: resource|resourceGroup|subscription
where:
- 'Effective permission is one of: Microsoft.KeyVault/vaults/privateEndpointConnections/write, Microsoft.Storage/storageAccounts/privateEndpointConnections/write,
  Microsoft.Sql/servers/privateEndpointConnections/write, Microsoft.ServiceBus/namespaces/privateEndpointConnections/write,
  Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write, Microsoft.Cache/redis/privateEndpointConnections/write,
  Microsoft.ContainerRegistry/registries/privateEndpointConnections/write, Microsoft.CognitiveServices/accounts/privateEndpointConnections/write,
  Microsoft.Search/searchServices/privateEndpointConnections/write, or any resource-type equivalent included
  via Contributor / Owner.'
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <PaaS resource (Key Vault / Storage / SQL / etc.) that owns the PE connection>
  permissions:
  - Microsoft.KeyVault/vaults/privateEndpointConnections/write
  - Microsoft.Storage/storageAccounts/privateEndpointConnections/write
  - Microsoft.Sql/servers/privateEndpointConnections/write
  - Microsoft.ServiceBus/namespaces/privateEndpointConnections/write
  - Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write
  - Microsoft.Cache/redis/privateEndpointConnections/write
  - Microsoft.ContainerRegistry/registries/privateEndpointConnections/write
  - Microsoft.CognitiveServices/accounts/privateEndpointConnections/write
  - Microsoft.Search/searchServices/privateEndpointConnections/write
  state_logic: 'ACTIVE: the principal can immediately approve any pending PE connection on the resource.
    The capability is realized at approval time; a Pending PE from an attacker VNet may or may not exist
    yet. If only Pending connections exist in an attacker-controlled subscription: ACTIVE (attacker creates
    PE + approves). If no Pending connections exist: POTENTIAL (attacker must first create a PE in a VNet
    they control, then approve it using this permission).'
  derived_from:
  - '<effective permission record: <resource>/privateEndpointConnections/write>'
  false_positive_note: Approving a PE connection grants NETWORK-LAYER access to the resource from the
    consumer VNet; data-plane authentication (RBAC or SAS key or connection string) is STILL required
    for actual data access. This edge models the network control capability, not data-plane auth. A deny
    assignment covering privateEndpointConnections/write at the resource or RG scope -> emit BLOCKED.
    Contributor and Owner roles include this capability via the wildcard action. Reader and custom roles
    without explicit */write do NOT have it.
  narrative: '{principal.name} can approve private endpoint connection requests on {target.name} (privateEndpointConnections/write).
    Approving a PE from an attacker-controlled VNet grants that VNet private network access to {target.name},
    bypassing its public firewall.'