azure-sb-public-endpoint

A Service Bus namespace with publicNetworkAccess=Enabled and no restrictive IP filter is reachable from the internet; any holder of a valid SAS key or Entra token can connect from any IP.

derived azure emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

target type	`AnonymousIdentity`
source	`?namespace`
target	`<AnonymousIdentity>`
conditions	`network_reachability`
state logic	ACTIVE when publicNetworkAccess=Enabled AND the network rule set defaultAction=Allow (no IP or VNet restriction). This is NOT truly anonymous — a valid SAS key or Entra token is required — but the endpoint is REACHABLE from any IP, so any party holding a credential can connect. If defaultAction=Deny with restrictive IP rules, CONDITIONAL( network_reachability). If publicNetworkAccess=Disabled, BLOCKED.

target type

AnonymousIdentity

source

?namespace

target

<AnonymousIdentity>

conditions

network_reachability

state logic

ACTIVE when publicNetworkAccess=Enabled AND the network rule set defaultAction=Allow (no IP or VNet restriction). This is NOT truly anonymous — a valid SAS key or Entra token is required — but the endpoint is REACHABLE from any IP, so any party holding a credential can connect. If defaultAction=Deny with restrictive IP rules, CONDITIONAL( network_reachability). If publicNetworkAccess=Disabled, BLOCKED.

Narrative

Service Bus namespace {namespace.name} is reachable from the public internet (publicNetworkAccess=Enabled, defaultAction=Allow); any party holding a valid SAS connection string or Entra token can connect from any IP without needing VPN or private network access.

Raw rule rules/derived/azure/servicebus.yaml

id: azure-sb-public-endpoint
emits: ExposedToInternet
description: A Service Bus namespace with publicNetworkAccess=Enabled and no restrictive IP filter is
  reachable from the internet; any holder of a valid SAS key or Entra token can connect from any IP.
match:
- - namespace: null
  - LocatedIn
  - resourcegroup: null
where:
- node_type(?namespace) == GenericMessaging
- ?namespace.publicNetworkAccess == Enabled (or not set; default is Enabled)
- ?namespace network rule set has defaultAction=Allow (or no restrictive IP/VNet rules)
emit:
  target_type: AnonymousIdentity
  source: ?namespace
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "ACTIVE when publicNetworkAccess=Enabled AND the network rule set defaultAction=Allow (no\
    \ IP or VNet restriction). This is NOT truly anonymous \u2014 a valid SAS key or Entra token is required\
    \ \u2014 but the endpoint is REACHABLE from any IP, so any party holding a credential can connect.\
    \ If defaultAction=Deny with restrictive IP rules, CONDITIONAL( network_reachability). If publicNetworkAccess=Disabled,\
    \ BLOCKED."
  confidence: 0.9
  derived_from:
  - namespace.publicNetworkAccess = Enabled
  - networkRuleSets.defaultAction = Allow (or no rules)
  false_positive_note: Service Bus data-plane endpoints require authentication (SAS key or Entra token);
    this is NOT an unauthenticated public exposure. The edge models network REACHABILITY, not unauthenticated
    access. It is high-value when paired with a leaked SAS connection string (CanReadSecret chain) because
    the leaked credential is then usable from any internet source. If IP firewall rules restrict access
    to specific CIDR ranges, downgrade to CONDITIONAL(network_reachability). If publicNetworkAccess=Disabled,
    BLOCKED regardless of the credential state.
  narrative: Service Bus namespace {namespace.name} is reachable from the public internet (publicNetworkAccess=Enabled,
    defaultAction=Allow); any party holding a valid SAS connection string or Entra token can connect from
    any IP without needing VPN or private network access.