azure-sql-server-allow-azure-services

Allow Azure services rule (startIp=endIp=0.0.0.0) exposes the SQL server to all Azure tenants and multi-tenant services - not public internet but broad cross-tenant exposure.

derived azure emits ExposedToTenant

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'server': None} Contains {'firewallRule': None}

where

node_type(?server) == RelationalDatabase ?server.provider_type == 'Microsoft.Sql/servers' ?server.properties.publicNetworkAccess != 'Disabled' node_type(?firewallRule) == Firewall ?firewallRule.provider_type == 'Microsoft.Sql/servers/firewallRules' ?firewallRule.properties.startIpAddress == '0.0.0.0' ?firewallRule.properties.endIpAddress == '0.0.0.0' # the AllowAllWindowsAzureIps sentinel

emit

source type	`RelationalDatabase`
target type	`Tenant`
source	`?server`
target	`<Azure public cloud Tenant boundary>`
conditions	`network_reachability`
state logic	if ?server.properties.publicNetworkAccess == 'Disabled': DO NOT EMIT; else ACTIVE: any Azure-hosted service (any tenant, any subscription) can reach the SQL server on port 1433 from an Azure datacenter IP. The actual risk is any Azure resource (compute, container, CI/CD runner) across ALL Azure tenants can initiate a TCP connection to port 1433. Authentication is still required, but the network exposure is tenant-broad.

Narrative

{server.name} has the "Allow Azure services and resources" firewall option enabled (startIp=endIp=0.0.0.0). This allows any compute resource in any Azure tenant or subscription to reach the SQL server on port 1433. While not the full public internet, it is broad enough that any Azure-hosted attacker infrastructure - across any tenant - can initiate TCP connections.

Raw rule rules/derived/azure/sql.yaml

id: azure-sql-server-allow-azure-services
emits: ExposedToTenant
description: "Allow Azure services rule (startIp=endIp=0.0.0.0) exposes the SQL server to all Azure tenants\
  \ and multi-tenant services \u2014 not public internet but broad cross-tenant exposure."
match:
- - server: null
  - Contains
  - firewallRule: null
where:
- node_type(?server) == RelationalDatabase
- ?server.provider_type == 'Microsoft.Sql/servers'
- ?server.properties.publicNetworkAccess != 'Disabled'
- node_type(?firewallRule) == Firewall
- ?firewallRule.provider_type == 'Microsoft.Sql/servers/firewallRules'
- ?firewallRule.properties.startIpAddress == '0.0.0.0'
- '?firewallRule.properties.endIpAddress == ''0.0.0.0''  # the AllowAllWindowsAzureIps sentinel'
emit:
  source_type: RelationalDatabase
  target_type: Tenant
  source: ?server
  target: <Azure public cloud Tenant boundary>
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'if ?server.properties.publicNetworkAccess == ''Disabled'': DO NOT EMIT; else ACTIVE: any
    Azure-hosted service (any tenant, any subscription) can reach the SQL server on port 1433 from an
    Azure datacenter IP. The actual risk is any Azure resource (compute, container, CI/CD runner) across
    ALL Azure tenants can initiate a TCP connection to port 1433. Authentication is still required, but
    the network exposure is tenant-broad.'
  confidence: '0.90'
  derived_from:
  - "<Contains edge_id (server \u2192 firewallRule)>"
  - <firewallRule.properties.startIpAddress/endIpAddress == 0.0.0.0/0.0.0.0>
  false_positive_note: "This is NOT ExposedToInternet \u2014 the 0.0.0.0/0.0.0.0 firewall rule maps to\
    \ Azure's internal \"AllowAllWindowsAzureIps\" service tag (Azure datacenter IPs only). Home broadband\
    \ or non-Azure cloud IPs cannot reach the server via this rule. The risk is cross-tenant Azure-based\
    \ attacker infrastructure (VMs, ACI, Functions, GitHub Actions runners in Azure, etc.). ExposedToInternet\
    \ applies only when endIpAddress=255.255.255.255 (see azure-sql-server-public-firewall). Do not collapse\
    \ ExposedToTenant into ExposedToInternet in the UI."
  narrative: "{server.name} has the \"Allow Azure services and resources\" firewall option enabled (startIp=endIp=0.0.0.0).\
    \ This allows any compute resource in any Azure tenant or subscription to reach the SQL server on\
    \ port 1433. While not the full public internet, it is broad enough that any Azure-hosted attacker\
    \ infrastructure \u2014 across any tenant \u2014 can initiate TCP connections."