azure-pl-dns-zone-link-record
A Microsoft.Network/privateDnsZones/virtualNetworkLinks ARM record directly observes that a private DNS zone is linked to a VNet. This is a structural fact: the zone's DNS records apply to name resolution within that VNet.
where
properties.provisioningState == 'Succeeded'
properties.virtualNetwork.id is non-empty
emit
| source type | DNS |
|---|---|
| target type | VirtualNetwork |
| source | <private DNS zone> |
| target | <linked VNet> |
| state logic | ACTIVE |
Narrative
Private DNS zone {zone.name} is linked to VNet {vnet.name} (virtualNetworkLink: {link.name}); resources in {vnet.name} resolve PaaS FQDNs via this zone.
Raw rule rules/explicit/azure-privatelink.yaml
id: azure-pl-dns-zone-link-record
emits: LocatedIn
description: 'A Microsoft.Network/privateDnsZones/virtualNetworkLinks ARM record directly observes that
a private DNS zone is linked to a VNet. This is a structural fact: the zone''s DNS records apply to
name resolution within that VNet.'
source_config:
resource_type: Microsoft.Network/privateDnsZones/virtualNetworkLinks
field: properties
where:
- properties.provisioningState == 'Succeeded'
- properties.virtualNetwork.id is non-empty
emit:
source_type: DNS
target_type: VirtualNetwork
source: <private DNS zone>
target: <linked VNet>
api_source: Microsoft.Network/privateDnsZones/virtualNetworkLinks GET
evidence_field: properties.virtualNetwork.id + properties.provisioningState
state_logic: ACTIVE
note: "LocatedIn in edges.yaml: source=[*], target=[AdministrativeBoundary, Network]. DNS \u2192 VirtualNetwork\
\ is valid (Network is the target category). This edge records which VNets receive name resolution\
\ from this private DNS zone."
narrative: 'Private DNS zone {zone.name} is linked to VNet {vnet.name} (virtualNetworkLink: {link.name});
resources in {vnet.name} resolve PaaS FQDNs via this zone.'