azure-pl-auto-approval-sub

If the backing PaaS resource (Key Vault, Storage, etc.) has a non-empty autoApprovalSubIds list in its privateEndpointConnections properties, and a PE is created in a subscription matching that list, the connection is auto-approved (no manual approval step required). Creating a PE in that subscription immediately grants the consumer VNet private access to the resource.

explicit azure emits PrivateReachability

source type	`Compute`
target type	`PrivateEndpoint`
source	`<Compute resources in the PE's VNet (the auto-approved consumer subscription's VNet)>`
target	`<private endpoint node>`
state logic	ACTIVE

source type

Compute

target type

PrivateEndpoint

source

<Compute resources in the PE's VNet (the auto-approved consumer subscription's VNet)>

target

<private endpoint node>

state logic

ACTIVE

Narrative

Subscription {approvedSub.id} is on the auto-approval list for {linkedService.name}. Any PE created in {approvedSub.id} connecting to {linkedService.name} is automatically Approved, immediately granting private network access without owner interaction. Compute in the PE's VNet can reach {linkedService.name} at its private IP.

Raw rule rules/explicit/azure-privatelink.yaml

id: azure-pl-auto-approval-sub
emits: PrivateReachability
description: If the backing PaaS resource (Key Vault, Storage, etc.) has a non-empty autoApprovalSubIds
  list in its privateEndpointConnections properties, and a PE is created in a subscription matching that
  list, the connection is auto-approved (no manual approval step required). Creating a PE in that subscription
  immediately grants the consumer VNet private access to the resource.
source_config:
  resource_type: <resource-type with privateEndpointConnections support>
  field: properties.privateEndpointConnections[].properties
where:
- properties.privateEndpointConnections[].properties.autoApprovalSubIds is non-empty
- a PE resource exists with subscriber-segment of its id matching an entry in autoApprovalSubIds
- properties.privateDnsZoneGroups on the PE is non-empty (DNS linked)
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <Compute resources in the PE's VNet (the auto-approved consumer subscription's VNet)>
  target: <private endpoint node>
  api_source: Microsoft.KeyVault/vaults GET, Microsoft.Storage/storageAccounts GET, etc.
  evidence_field: properties.privateEndpointConnections[].properties.autoApprovalSubIds
  properties:
    auto_approved: true
    approved_subscription: <subscription matching autoApprovalSubIds entry>
  state_logic: ACTIVE
  narrative: Subscription {approvedSub.id} is on the auto-approval list for {linkedService.name}. Any
    PE created in {approvedSub.id} connecting to {linkedService.name} is automatically Approved, immediately
    granting private network access without owner interaction. Compute in the PE's VNet can reach {linkedService.name}
    at its private IP.