azure-pl-pe-write
Write access to a private endpoint object (privateEndpoints/write) grants full control of that PE - NIC, DNS zone groups, and subnet placement - enabling the attacker to reconfigure where private traffic flows.
match (effective permission)
{
"action": "Microsoft.Network/privateEndpoints/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | PrivateEndpoint |
| source | <principal> |
| target | <private endpoint> |
| permissions | Microsoft.Network/privateEndpoints/write |
| state logic | ACTIVE |
Narrative
{principal.name} has full control of private endpoint {target.name} (Microsoft.Network/privateEndpoints/write), including its NIC placement, subnet, and DNS zone group configuration.
Raw rule rules/explicit/azure-privatelink.yaml
id: azure-pl-pe-write
emits: CanAdminister
description: "Write access to a private endpoint object (privateEndpoints/write) grants full control of\
\ that PE \u2014 NIC, DNS zone groups, and subnet placement \u2014 enabling the attacker to reconfigure\
\ where private traffic flows."
match_effective_permission:
action: Microsoft.Network/privateEndpoints/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: PrivateEndpoint
source: <principal>
target: <private endpoint>
permissions:
- Microsoft.Network/privateEndpoints/write
state_logic: ACTIVE
derived_from:
- '<effective permission record: privateEndpoints/write>'
false_positive_note: CanAdminister on a PE grants config control but NOT Microsoft.Authorization/*/write;
it does not let the attacker assign RBAC. Escalation runs through reconfiguring DNS zone groups (azure-pl-pe-dnsgroup-write)
or replacing the PE's NIC/subnet placement. CanAdminister -> Controls is derived by can-control.yaml
(cited, not duplicated here). Network Contributor and Contributor/Owner roles include privateEndpoints/write
at the applicable scope.
narrative: '{principal.name} has full control of private endpoint {target.name} (Microsoft.Network/privateEndpoints/write),
including its NIC placement, subnet, and DNS zone group configuration.'