azure-pl-pe-connection-cross-sub

A Microsoft.Network/privateEndpoints ARM record where the PE subscription differs from the backing resource's subscription (cross-subscription connection) directly establishes cross-subscription private reachability. The connection is approved and DNS-configured, so network traffic flows across the subscription boundary.

explicit azure emits PrivateReachability

source type	`Compute`
target type	`PrivateEndpoint`
source	`<Compute resources in the consumer VNet that hosts this PE>`
target	`<private endpoint node (cross-subscription, Approved)>`
state logic	ACTIVE

source type

Compute

target type

PrivateEndpoint

source

<Compute resources in the consumer VNet that hosts this PE>

target

<private endpoint node (cross-subscription, Approved)>

state logic

ACTIVE

Private endpoint {pe.name} crosses subscription boundaries (consumer sub {consumerSub} → provider resource in sub {providerSub}, Approved); consumer VNet compute has private reach to {linkedService.name} without traversing the public internet.

Raw rule rules/explicit/azure-privatelink.yaml

id: azure-pl-pe-connection-cross-sub
emits: PrivateReachability
description: A Microsoft.Network/privateEndpoints ARM record where the PE subscription differs from the
  backing resource's subscription (cross-subscription connection) directly establishes cross-subscription
  private reachability. The connection is approved and DNS-configured, so network traffic flows across
  the subscription boundary.
source_config:
  resource_type: Microsoft.Network/privateEndpoints
  field: properties
where:
- properties.provisioningState == 'Succeeded'
- properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
- subscription-segment of PE resource id != subscription-segment of privateLinkServiceConnections[].privateLinkServiceId
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <Compute resources in the consumer VNet that hosts this PE>
  target: <private endpoint node (cross-subscription, Approved)>
  api_source: Microsoft.Network/privateEndpoints GET
  evidence_field: properties.privateLinkServiceConnections[].privateLinkServiceId (cross-subscription
    check)
  properties:
    cross_subscription: true
  state_logic: ACTIVE
  narrative: "Private endpoint {pe.name} crosses subscription boundaries (consumer sub {consumerSub} \u2192\
    \ provider resource in sub {providerSub}, Approved); consumer VNet compute has private reach to {linkedService.name}\
    \ without traversing the public internet."

azure-pl-pe-connection-cross-sub

where

emit

Narrative

Raw rule rules/explicit/azure-privatelink.yaml