azure-pl-pls-write

id: azure-pl-pls-write
emits: CanModifyConfiguration
description: Write access to a Private Link Service (PLS) lets an attacker create or modify a PLS that
  fronts an attacker-controlled backend. This edge models the control-plane write capability (can create/modify
  a PLS), not the data-plane traffic interception (which is conditional on a consumer connecting to it).
match_effective_permission:
  action: Microsoft.Network/privateLinkServices/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: PrivateEndpoint
  source: <principal>
  target: <Private Link Service>
  permissions:
  - Microsoft.Network/privateLinkServices/write
  state_logic: 'ACTIVE: the principal can immediately create or modify a PLS. The write capability is
    directly exercisable. Network traffic interception is realized only after a consumer VNet creates
    a PE to this PLS and the connection is approved; that traffic-flow scenario is modeled by a separate
    derived rule (see below).'
  derived_from:
  - '<effective permission record: privateLinkServices/write>'
  false_positive_note: 'A PLS routes network traffic to a backend load-balancer IP; TLS is terminated
    by the backend application. If the PaaS service uses TLS with certificate pinning or mutual TLS, simple
    traffic redirection will not yield plaintext interception (but may cause connection failures or DoS).
    The high-value case is PLS fronting a cleartext or attacker-TLS-terminated service. Also: PLS requires
    an internal Azure Standard Load Balancer frontend as the origin; the attacker must control compute
    behind that LB to actually intercept traffic. Network Contributor includes privateLinkServices/write;
    Contributor/Owner inherit it.'
  narrative: '{principal.name} can write Private Link Service {target.name} (privateLinkServices/write),
    enabling creation or modification of a PLS.'