azure-pl-cross-sub-pe-trust
An Approved private endpoint connection that crosses subscription boundaries extends private network reach across the subscription boundary: a foothold in the consumer VNet (sub A) gains private network access to the PaaS resource in the provider subscription (sub B).
where
Microsoft.Network/privateEndpoints PE record: properties.provisioningState == 'Succeeded'
properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
PE subscription-segment of properties.id != subscription-segment of the backing resource's id
private
DNS zone group is attached and A record resolves the PaaS FQDN to the PE private IP
emit
| source type | Compute |
|---|---|
| target type | PrivateEndpoint |
| source | <Compute resource in the consumer VNet (the VNet hosting the PE)> |
| target | <private endpoint node (in the consumer subscription, fronting the cross-sub PaaS resource)> |
| conditions | network_reachability |
| state logic | CONDITIONAL(network_reachability): connection is Approved and DNS resolves, but source must be confirmed in the consumer VNet. ACTIVE when source compute is in the same or peered VNet as the PE subnet with no blocking NSG. CONDITIONAL if only one subscription is in collected inventory (collection gap on the other side). |
Narrative
Private endpoint {target.name} (in subscription {consumerSub.id}) has an Approved cross-subscription connection to {linkedService.name} (in subscription {providerSub.id}). A foothold in the consumer VNet grants private network access to {linkedService.name} across the subscription boundary without traversing the internet.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-cross-sub-pe-trust
emits: PrivateReachability
description: 'An Approved private endpoint connection that crosses subscription boundaries extends private
network reach across the subscription boundary: a foothold in the consumer VNet (sub A) gains private
network access to the PaaS resource in the provider subscription (sub B).'
where:
- 'Microsoft.Network/privateEndpoints PE record: properties.provisioningState == ''Succeeded'''
- properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
- PE subscription-segment of properties.id != subscription-segment of the backing resource's id
- private DNS zone group is attached and A record resolves the PaaS FQDN to the PE private IP
emit:
source_type: Compute
target_type: PrivateEndpoint
source: <Compute resource in the consumer VNet (the VNet hosting the PE)>
target: <private endpoint node (in the consumer subscription, fronting the cross-sub PaaS resource)>
permissions: []
properties:
cross_subscription: true
consumer_subscription: <subscription hosting the PE>
provider_subscription: <subscription hosting the PaaS resource>
conditions:
- network_reachability
state_logic: 'CONDITIONAL(network_reachability): connection is Approved and DNS resolves, but source
must be confirmed in the consumer VNet. ACTIVE when source compute is in the same or peered VNet as
the PE subnet with no blocking NSG. CONDITIONAL if only one subscription is in collected inventory
(collection gap on the other side).'
derived_from:
- <PE ARM record (cross-subscription connection, Approved state)>
- <privateDnsZoneGroup record>
false_positive_note: "Same conditions as azure-pl-pe-private-reachability: PE must be Approved, DNS\
\ must resolve, and source must be in the same/peered VNet. Additionally, the cross-subscription check\
\ requires confirming BOTH subscription IDs differ (from the PE's resource ID vs. the privateLinkServiceId).\
\ ARM RBAC does NOT cross subscription boundaries via a PE \u2014 only network traffic flows cross-sub.\
\ Pending connections do not carry traffic; do not emit for Pending state."
narrative: Private endpoint {target.name} (in subscription {consumerSub.id}) has an Approved cross-subscription
connection to {linkedService.name} (in subscription {providerSub.id}). A foothold in the consumer
VNet grants private network access to {linkedService.name} across the subscription boundary without
traversing the internet.