azure-pl-pe-private-reachability
An Approved private endpoint with a working private DNS zone group makes the backing PaaS resource (Key Vault, Storage, SQL, etc.) reachable at a private IP from any compute in the same VNet or a peered VNet - bypassing the public firewall.
where
Microsoft.Network/privateEndpoints resource with properties.provisioningState == 'Succeeded'
properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
properties.privateDnsZoneGroups is non-empty (
DNS zone group linking the PE to a private zone)
the private DNS zone has an A record mapping the PaaS service FQDN to the PE's private IP
emit
| source type | Compute |
|---|---|
| target type | PrivateEndpoint |
| source | <Compute resource located in the same VNet as the PE's subnet, or in a peered VNet with allowVirtualNetworkAccess=true> |
| target | <private endpoint node (and the PaaS resource it fronts)> |
| conditions | network_reachability |
| state logic | CONDITIONAL(network_reachability): the PE is approved and DNS resolves, but actual reachability from a specific compute source requires: (a) source is in the same VNet as the PE subnet, OR (b) source is in a peered VNet with allowVirtualNetworkAccess=true, OR (c) source is connected via a VPN/ExpressRoute that routes to the PE subnet. Additionally, if PrivateLinkNetworkPolicies == Enabled on the PE subnet, NSG rules on that subnet must allow the source IP. Emit ACTIVE only when the source is confirmed in the same subnet or VNet with no blocking NSG confirmed. Do NOT emit if provisioningState != Succeeded or connection status != Approved. |
Narrative
Private endpoint {target.name} is Approved and DNS-configured for {linkedService.name}; any compute in VNet {vnet.name} (or a peered VNet) can reach {linkedService.name} at its private IP without an internet path, bypassing the public firewall.
Raw rule rules/derived/azure/privatelink.yaml
id: azure-pl-pe-private-reachability
emits: PrivateReachability
description: "An Approved private endpoint with a working private DNS zone group makes the backing PaaS\
\ resource (Key Vault, Storage, SQL, etc.) reachable at a private IP from any compute in the same VNet\
\ or a peered VNet \u2014 bypassing the public firewall."
where:
- Microsoft.Network/privateEndpoints resource with properties.provisioningState == 'Succeeded'
- properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
- properties.privateDnsZoneGroups is non-empty (DNS zone group linking the PE to a private zone)
- the private DNS zone has an A record mapping the PaaS service FQDN to the PE's private IP
emit:
source_type: Compute
target_type: PrivateEndpoint
source: <Compute resource located in the same VNet as the PE's subnet, or in a peered VNet with allowVirtualNetworkAccess=true>
target: <private endpoint node (and the PaaS resource it fronts)>
permissions: []
conditions:
- network_reachability
state_logic: "CONDITIONAL(network_reachability): the PE is approved and DNS resolves, but actual reachability\
\ from a specific compute source requires:\n (a) source is in the same VNet as the PE subnet, OR\n\
\ (b) source is in a peered VNet with allowVirtualNetworkAccess=true, OR\n (c) source is connected\
\ via a VPN/ExpressRoute that routes to the PE subnet.\nAdditionally, if PrivateLinkNetworkPolicies\
\ == Enabled on the PE subnet, NSG rules on that subnet must allow the source IP. Emit ACTIVE only\
\ when the source is confirmed in the same subnet or VNet with no blocking NSG confirmed. Do NOT emit\
\ if provisioningState != Succeeded or connection status != Approved."
derived_from:
- <PE ARM record (provisioningState + connectionState)>
- <privateDnsZoneGroup record>
- <private DNS zone A record>
false_positive_note: "Three independent facts must ALL hold: (1) PE provisioningState == Succeeded,\
\ (2) connection status == Approved (not Pending or Rejected), (3) a private DNS zone group is attached\
\ and the zone has an A record mapping the service FQDN to the PE's private IP. Missing any of these\
\ means the PE either carries no traffic (not Approved) or DNS still resolves to the public IP (no\
\ zone/record). Also: if publicNetworkAccess is STILL Enabled on the target resource, the PE provides\
\ an ADDITIONAL private path but does not make the resource PE-only. Do not mark the resource as firewall-restricted\
\ unless publicNetworkAccess == Disabled. If PrivateLinkNetworkPolicies == Enabled on the PE subnet,\
\ NSG rules apply to PE traffic \u2014 confirm no blocking rule before emitting ACTIVE."
narrative: Private endpoint {target.name} is Approved and DNS-configured for {linkedService.name}; any
compute in VNet {vnet.name} (or a peered VNet) can reach {linkedService.name} at its private IP without
an internet path, bypassing the public firewall.