azure-pl-approve-cross-sub

An identity with <resource>/privateEndpointConnections/write on a PaaS resource can approve a private endpoint connection from a different subscription. Approving such a connection records a cross-subscription trust: the resource owner has explicitly authorized a network connection from another subscription's VNet, extending the reach of that remote VNet across the subscription boundary.

explicit azure emits CrossAccountTrust

match (effective permission)

{ "action": "\u003cresource-type\u003e/privateEndpointConnections/write", "scope_type": "resource|resourceGroup|subscription" }

where

The PE connection is from a subscription other than the target resource's subscription (detected via properties.privateLinkServiceConnections[].privateLinkServiceId).

emit

source type	`ResourcePolicy`
target type	`Subscription`
source	`<resource policy approval record (implicit: identity with privateEndpointConnections/write)>`
target	`<consumer subscription (the subscription hosting the cross-sub PE)>`
permissions	`Microsoft.KeyVault/vaults/privateEndpointConnections/write` `Microsoft.Storage/storageAccounts/privateEndpointConnections/write` `Microsoft.Sql/servers/privateEndpointConnections/write` `Microsoft.ServiceBus/namespaces/privateEndpointConnections/write` `Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write` `Microsoft.Cache/redis/privateEndpointConnections/write` `Microsoft.ContainerRegistry/registries/privateEndpointConnections/write` `Microsoft.CognitiveServices/accounts/privateEndpointConnections/write` `Microsoft.Search/searchServices/privateEndpointConnections/write`
state logic	ACTIVE: the approval is complete (connection status = Approved). The cross-subscription trust is now in effect, recording that the provider has authorized this consumer's network connection.

Narrative

Cross-subscription PE connection from {consumerSub.id} to {linkedService.name} (in {providerSub.id}) is Approved. The resource owner has recorded a cross-subscription trust allowing the consumer VNet private network access.

Raw rule rules/explicit/azure-privatelink.yaml

id: azure-pl-approve-cross-sub
emits: CrossAccountTrust
description: 'An identity with <resource>/privateEndpointConnections/write on a PaaS resource can approve
  a private endpoint connection from a different subscription. Approving such a connection records a cross-subscription
  trust: the resource owner has explicitly authorized a network connection from another subscription''s
  VNet, extending the reach of that remote VNet across the subscription boundary.'
match_effective_permission:
  action: <resource-type>/privateEndpointConnections/write
  scope_type: resource|resourceGroup|subscription
where:
- The PE connection is from a subscription other than the target resource's subscription (detected via
  properties.privateLinkServiceConnections[].privateLinkServiceId).
emit:
  source_type: ResourcePolicy
  target_type: Subscription
  source: '<resource policy approval record (implicit: identity with privateEndpointConnections/write)>'
  target: <consumer subscription (the subscription hosting the cross-sub PE)>
  permissions:
  - Microsoft.KeyVault/vaults/privateEndpointConnections/write
  - Microsoft.Storage/storageAccounts/privateEndpointConnections/write
  - Microsoft.Sql/servers/privateEndpointConnections/write
  - Microsoft.ServiceBus/namespaces/privateEndpointConnections/write
  - Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write
  - Microsoft.Cache/redis/privateEndpointConnections/write
  - Microsoft.ContainerRegistry/registries/privateEndpointConnections/write
  - Microsoft.CognitiveServices/accounts/privateEndpointConnections/write
  - Microsoft.Search/searchServices/privateEndpointConnections/write
  properties:
    cross_subscription: true
    provider_subscription: <subscription hosting the PaaS resource>
    consumer_subscription: <subscription hosting the PE>
  state_logic: 'ACTIVE: the approval is complete (connection status = Approved). The cross-subscription
    trust is now in effect, recording that the provider has authorized this consumer''s network connection.'
  derived_from:
  - '<PE connection record: cross-subscription + Approved state>'
  - '<effective permission: privateEndpointConnections/write>'
  false_positive_note: CrossAccountTrust models the authorization relationship, not the network fact.
    The network reachability itself is modeled by PrivateReachability. An identity with privateEndpointConnections/write
    can CREATE additional approvals, but this edge captures the EXISTING approval recorded in the resource's
    privateEndpointConnections array.
  narrative: Cross-subscription PE connection from {consumerSub.id} to {linkedService.name} (in {providerSub.id})
    is Approved. The resource owner has recorded a cross-subscription trust allowing the consumer VNet
    private network access.