azure-vnet-nsg-inbound-open

id: azure-vnet-nsg-inbound-open
emits: CanReachPort
description: An NSG effective inbound rule allowing a source of Internet or 0.0.0.0/0 on a specific port/range
  means that port is reachable from the internet at the network layer. Source is the NSG/Subnet (a Network
  node), target is the compute resource behind it.
where:
- 'NSG effective inbound rule: source == ''Internet'' OR source == ''0.0.0.0/0'' (AnySource wildcard)'
- action == 'Allow', priority lower than any conflicting Deny rule at the same or higher priority
- the NSG is associated with a subnet or NIC hosting at least one resource
emit:
  source_type: Network
  target_type: Compute
  source: <NSG or Subnet node (Network class) associated with the rule>
  target: <compute resource (instance, App Service, LB, etc.) in that subnet/NIC>
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability) by default: the port is open at the NSG layer but requires
    a public IP or load-balancer frontend for actual internet reachability. Emit ACTIVE only when (1)
    confirmed public IP (PublicEndpoint node) is attached to the target resource or its NIC, AND (2) the
    effective NSG rule allows Internet/Any on a service port (not ephemeral). Match against optional PublicEndpoint
    attachment to upgrade from CONDITIONAL to ACTIVE.'
  false_positive_note: 'Always evaluate EFFECTIVE NSG rules (use Microsoft.Network/networkInterfaces/
    effectiveNetworkSecurityGroups/action or the subnet-level effective rules API), not raw rule objects.
    A raw allow rule may be shadowed by a higher-priority Deny. The default DenyAllInbound rule has priority
    65500; any explicit allow with lower priority (higher precedence) overrides it. The internet source
    tag matches all public IPs but not RFC-1918 ranges; AnySource (0.0.0.0/0 or ''*'') matches all including
    private. Emit only when the effective rule allows inbound from the internet source. Do not emit if
    resource has no public IP and is not behind a public load balancer (the port may be open in the NSG
    but unreachable without a public entry point). Also check for resource-level publicNetworkAccess:
    Disabled (overrides NSG).'
  narrative: NSG {source.name} has an effective inbound allow rule for source Internet/Any on the specified
    port; {target.name} in that subnet can be reached from the public internet at the firewall layer.
  derived_from:
  - <effective NSG inbound rule record>