azure-pl-pe-record
A Microsoft.Network/privateEndpoints ARM record with provisioningState=Succeeded, connection status=Approved, and a privateDnsZoneGroup attachment directly establishes that the backing PaaS resource is privately reachable from compute in the same or peered VNet. This is a structural fact observed in the PE resource properties.
where
properties.provisioningState == 'Succeeded'
properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
properties.privateDnsZoneGroups is non-empty
emit
| source type | Compute |
|---|---|
| target type | PrivateEndpoint |
| source | <Compute resources in the same or peered VNet as the PE subnet> |
| target | <private endpoint node> |
| state logic | ACTIVE |
Narrative
Private endpoint {pe.name} (Approved, DNS-linked) makes {linkedService.name} privately reachable within VNet {vnet.name} at the PE's private IP address.
Raw rule rules/explicit/azure-privatelink.yaml
id: azure-pl-pe-record
emits: PrivateReachability
description: A Microsoft.Network/privateEndpoints ARM record with provisioningState=Succeeded, connection
status=Approved, and a privateDnsZoneGroup attachment directly establishes that the backing PaaS resource
is privately reachable from compute in the same or peered VNet. This is a structural fact observed in
the PE resource properties.
source_config:
resource_type: Microsoft.Network/privateEndpoints
field: properties
where:
- properties.provisioningState == 'Succeeded'
- properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
- properties.privateDnsZoneGroups is non-empty
emit:
source_type: Compute
target_type: PrivateEndpoint
source: <Compute resources in the same or peered VNet as the PE subnet>
target: <private endpoint node>
api_source: Microsoft.Network/privateEndpoints GET
evidence_field: properties.subnet.id + properties.privateLinkServiceConnections + properties.privateDnsZoneGroups
state_logic: ACTIVE
narrative: Private endpoint {pe.name} (Approved, DNS-linked) makes {linkedService.name} privately reachable
within VNet {vnet.name} at the PE's private IP address.