azure-pl-cross-sub-pe-authz
An Approved private endpoint connection from a different subscription records an authorization relationship: the resource owner (in the provider subscription) has approved a network connection from an external (consumer) subscription. This models the cross-subscription trust relationship established by the approval.
where
Microsoft.Network/privateEndpoints PE record: properties.provisioningState == 'Succeeded'
properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
PE subscription-segment of properties.id != subscription-segment of the backing resource's id
The PaaS resource's privateEndpointConnections array contains this PE connection with status=Approved
emit
| source type | ResourcePolicy |
|---|---|
| target type | Subscription |
| source | <resource policy approval record (the privateEndpointConnections entry on the backing resource)> |
| target | <consumer subscription (the external subscription hosting the PE)> |
| state logic | ACTIVE: the approval is recorded and in effect (connection status = Approved). The cross-subscription trust is now materialized, allowing network traffic to flow from the consumer subscription's VNet to the provider's PaaS resource. |
Narrative
PaaS resource {linkedService.name} (in subscription {providerSub.id}) has approved a PE connection from subscription {consumerSub.id}. This records a cross-subscription trust relationship enabling the external subscription's network access to the resource.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-cross-sub-pe-authz
emits: CrossAccountTrust
description: 'An Approved private endpoint connection from a different subscription records an authorization
relationship: the resource owner (in the provider subscription) has approved a network connection from
an external (consumer) subscription. This models the cross-subscription trust relationship established
by the approval.'
where:
- 'Microsoft.Network/privateEndpoints PE record: properties.provisioningState == ''Succeeded'''
- properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
- PE subscription-segment of properties.id != subscription-segment of the backing resource's id
- The PaaS resource's privateEndpointConnections array contains this PE connection with status=Approved
emit:
source_type: ResourcePolicy
target_type: Subscription
source: <resource policy approval record (the privateEndpointConnections entry on the backing resource)>
target: <consumer subscription (the external subscription hosting the PE)>
permissions: []
properties:
cross_subscription: true
provider_subscription: <subscription hosting the PaaS resource>
consumer_subscription: <external subscription hosting the PE>
state_logic: 'ACTIVE: the approval is recorded and in effect (connection status = Approved). The cross-subscription
trust is now materialized, allowing network traffic to flow from the consumer subscription''s VNet
to the provider''s PaaS resource.'
derived_from:
- <PE connection record in PaaS resource's privateEndpointConnections, status=Approved>
false_positive_note: This edge models the AUTHORIZATION relationship (cross-subscription trust), separate
from the network REACHABILITY fact (modeled by azure-pl-cross-sub-pe-trust). The approval is a policy
decision by the resource owner; the network path is the technical realization. Both edges are needed
for complete attack-path modeling.
narrative: PaaS resource {linkedService.name} (in subscription {providerSub.id}) has approved a PE connection
from subscription {consumerSub.id}. This records a cross-subscription trust relationship enabling
the external subscription's network access to the resource.