azure-vm-exposed-internet
VM with a public IP and an NSG rule allowing an inbound port.
where
VM NIC has an associated Microsoft.Network/publicIPAddresses
effective NSG (subnet or NIC) allows inbound on the service port (e.g. 22/3389/app)
emit
| target type | AnonymousIdentity |
|---|---|
| source | <virtualMachine> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{vm.name} is reachable from the internet on an open port (public IP + permissive NSG).
Raw rule rules/derived/azure/vm.yaml
id: azure-vm-exposed-internet
emits: ExposedToInternet
description: VM with a public IP and an NSG rule allowing an inbound port.
where:
- VM NIC has an associated Microsoft.Network/publicIPAddresses
- effective NSG (subnet or NIC) allows inbound on the service port (e.g. 22/3389/app)
emit:
target_type: AnonymousIdentity
source: <virtualMachine>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Do not emit if the effective NSG denies the port or the VM has no public IP; a
public IP alone without an allow rule is not exposure.
narrative: '{vm.name} is reachable from the internet on an open port (public IP + permissive NSG).'