azure-sf-gateway-exposed
SF cluster gateway (19000 FabricGateway / 19080 FabricHttpGateway+SFX) fronted by a public LB with a permissive NSG.
where
cluster LB/publicIPAddresses front gateway ports 19000 and/or 19080
effective NSG allows inbound on those ports
emit
| target type | AnonymousIdentity |
|---|---|
| source | <serviceFabric cluster> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{cluster.name} exposes its management gateway (19000/19080) to the internet (public LB + permissive NSG); data-plane auth still required.
Raw rule rules/derived/azure/servicefabric.yaml
id: azure-sf-gateway-exposed
emits: ExposedToInternet
description: SF cluster gateway (19000 FabricGateway / 19080 FabricHttpGateway+SFX) fronted by a public
LB with a permissive NSG.
where:
- cluster LB/publicIPAddresses front gateway ports 19000 and/or 19080
- effective NSG allows inbound on those ports
emit:
target_type: AnonymousIdentity
source: <serviceFabric cluster>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: 'Exposure of the gateway does NOT grant control: the data plane still requires
an admin/user client certificate or Entra token. Emit as reachability/entry-surface, not as authenticated
control. Do not emit if the NSG denies 19000/19080 or no public IP fronts them.'
narrative: '{cluster.name} exposes its management gateway (19000/19080) to the internet (public LB +
permissive NSG); data-plane auth still required.'