azure-vnet-nsg-internet-exposed

A compute resource or load balancer with a public IP AND an NSG rule that allows inbound Internet/0.0.0.0/0 on a port is internet-exposed.

derived azure emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`AnonymousIdentity`
source	`<compute resource or load balancer>`
target	`<AnonymousIdentity>`
conditions	`network_reachability`
state logic	ACTIVE when: (1) effective NSG inbound allows Internet/Any on the service port, AND (2) a public IP (or public LB frontend) is associated with the resource or its NIC. CONDITIONAL(network_reachability) if either condition is uncertain from collected data.

source type

Compute

target type

AnonymousIdentity

source

<compute resource or load balancer>

target

<AnonymousIdentity>

conditions

network_reachability

state logic

ACTIVE when: (1) effective NSG inbound allows Internet/Any on the service port, AND (2) a public IP (or public LB frontend) is associated with the resource or its NIC. CONDITIONAL(network_reachability) if either condition is uncertain from collected data.

Narrative

{resource.name} is exposed to the public internet: it has a public IP (or public load balancer frontend) and an NSG inbound allow rule for Internet/Any on a service port.

Raw rule rules/derived/azure/vnet.yaml

id: azure-vnet-nsg-internet-exposed
emits: ExposedToInternet
description: A compute resource or load balancer with a public IP AND an NSG rule that allows inbound
  Internet/0.0.0.0/0 on a port is internet-exposed.
match:
- - resource: null
  - CanReachPort
  - something: null
where:
- ?resource has an associated PublicEndpoint node (public IP address or public LB frontend)
- the NSG effective inbound rule allows Internet/Any on a service port (not just ephemeral)
emit:
  source_type: Compute
  target_type: AnonymousIdentity
  source: <compute resource or load balancer>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'ACTIVE when: (1) effective NSG inbound allows Internet/Any on the service port, AND (2)
    a public IP (or public LB frontend) is associated with the resource or its NIC. CONDITIONAL(network_reachability)
    if either condition is uncertain from collected data.'
  derived_from:
  - <CanReachPort edge_id>
  - <PublicEndpoint node linkage>
  false_positive_note: Do not emit if publicNetworkAccess is Disabled at the resource level (e.g., Storage
    Account, Key Vault, SQL with publicNetworkAccess=Disabled) even if the NSG rule appears open. The
    resource-level firewall overrides NSG. Only emit for resources that actually bind a public IP address
    (or are fronted by a public load balancer / Application Gateway with a public frontend). A private-endpoint-only
    resource behind an open NSG is NOT internet-exposed.
  narrative: '{resource.name} is exposed to the public internet: it has a public IP (or public load balancer
    frontend) and an NSG inbound allow rule for Internet/Any on a service port.'