azure-synapse-endpoints-public

id: azure-synapse-endpoints-public
emits: ExposedToInternet
description: Synapse workspace development, SQL, and Spark endpoints are public-internet reachable when
  publicNetworkAccess is Enabled and no private-endpoint-only restriction is applied.
match:
- - workspace: null
  - LocatedIn
  - rg: null
where:
- node_type(?workspace) == AnalyticsService
- provider_type(?workspace) == 'Microsoft.Synapse/workspaces'
- ?workspace.properties.publicNetworkAccess == Enabled
- NOT (private-endpoint-only firewall restriction on all relevant endpoints)
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: <Synapse workspace>
  target: <AnonymousIdentity>
  conditions:
  - network_reachability
  state_logic: "ACTIVE when publicNetworkAccess == Enabled with no firewall restriction narrowing to specific\
    \ IP ranges (or the range includes 0.0.0.0/0). Authentication is still required (no anonymous access),\
    \ but the network surface is public \u2014 ExposedToInternet models the network reachability exposure,\
    \ not anonymous data access. CONDITIONAL(network_reachability) when IP firewall rules are configured\
    \ but broad; BLOCKED when publicNetworkAccess == Disabled (private endpoint only)."
  false_positive_note: "ExposedToInternet here models the NETWORK SURFACE \u2014 the workspace endpoints\
    \ are reachable from the public internet. It does NOT imply anonymous data access; authentication\
    \ is still enforced. Emit even when auth is required: the internet exposure is the finding (attack\
    \ surface = public endpoint, enabling credential stuffing, brute force, and future unauthenticated\
    \ exploits)."
  narrative: Synapse workspace {workspace.name} exposes its development/SQL/Spark endpoints to the public
    internet (publicNetworkAccess Enabled); authentication is required but the surface is internet-reachable.