azure-sql-mi-public-endpoint

id: azure-sql-mi-public-endpoint
emits: ExposedToInternet
description: SQL Managed Instance with publicDataEndpointEnabled=true and an NSG allowing inbound TCP
  3342 from the internet is reachable by any internet host.
match:
- - mi: null
  - LocatedIn
  - subnet: null
- - subnet: null
  - Contains
  - nsg: null
- - nsg: null
  - Contains
  - nsgRule: null
where:
- node_type(?mi) == RelationalDatabase
- ?mi.provider_type == 'Microsoft.Sql/managedInstances'
- ?mi.properties.publicDataEndpointEnabled == true
- node_type(?subnet) == Network
- node_type(?nsg) == Firewall
- ?nsg.provider_type == 'Microsoft.Network/networkSecurityGroups'
- node_type(?nsgRule) == Firewall
- ?nsgRule.provider_type == 'Microsoft.Network/networkSecurityGroups/securityRules'
- ?nsgRule.properties.direction == 'Inbound'
- ?nsgRule.properties.access == 'Allow'
- ?nsgRule.properties.destinationPortRange == '3342' OR contains(?nsgRule.properties.destinationPortRange,
  '3342')
- '?nsgRule.properties.sourceAddressPrefix in [''0.0.0.0/0'', ''*'', ''<nw>/0'', ''Internet'']  # Allow
  rule from internet'
emit:
  source_type: RelationalDatabase
  target_type: AnonymousIdentity
  source: ?mi
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "if ?mi.properties.publicDataEndpointEnabled == false: DO NOT EMIT (the MI has no public\
    \ endpoint); elif NSG has no inbound allow rule for port 3342 from 0.0.0.0/0 or Internet tag: CONDITIONAL(network_reachability)\
    \ \u2014 the endpoint is enabled but NSG blocks external access; else ACTIVE: internet hosts can reach\
    \ the MI on port 3342. Note: SQL MI public endpoint always enforces TLS; the exposure is the TCP reachability\
    \ and authentication surface, not plaintext data."
  confidence: '0.92'
  derived_from:
  - <mi.properties.publicDataEndpointEnabled>
  - <nsgRule inbound port 3342 from internet>
  false_positive_note: "publicDataEndpointEnabled=false (the default) means the MI has NO public IP and\
    \ is strictly VNet-internal \u2014 do not emit. When true, ALSO check the NSG on the MI's delegated\
    \ subnet: if the NSG denies inbound 3342, the endpoint is configured but not reachable \u2014 emit\
    \ as CONDITIONAL(network_reachability). SQL MI always communicates on port 3342 (not 1433) on the\
    \ public endpoint; 1433 is only used on the private VNet endpoint. The public endpoint enforces server\
    \ TLS; the exposure is the unauthenticated TCP reachability and authentication surface (SQL auth or\
    \ Entra auth over TLS)."
  narrative: '{mi.name} has its public data endpoint enabled (port 3342) and the subnet NSG allows inbound
    internet traffic on that port. Any internet host can attempt SQL or Entra authentication against this
    Managed Instance.'