azure-vnet-pe-write

id: azure-vnet-pe-write
emits: CanModifyConfiguration
description: "Write access to Microsoft.Network/privateEndpoints lets an attacker create a new private\
  \ endpoint connecting a sensitive PaaS resource (Storage, Key Vault, SQL, etc.) to an in-VNet IP address\
  \ \u2014 enabling a foothold in the VNet to reach that resource via PrivateReachability without internet\
  \ traversal."
match_effective_permission:
  action: Microsoft.Network/privateEndpoints/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Network
  source: <principal>
  target: <VirtualNetwork>
  permissions:
  - Microsoft.Network/privateEndpoints/write
  state_logic: ACTIVE
  false_positive_note: privateEndpoints/write allows creating and managing private endpoints. An attacker
    with this permission can create a PE connecting any PaaS resource (within their scope) to a VNet,
    bypassing internet-layer isolation. Combined with network access to the VNet (LocatedIn a Compute
    in that VNet), the attacker gains unfiltered access to the PaaS resource. Honor deny assignments.
  narrative: '{principal.name} can create or modify private endpoints in {target.name} (Microsoft.Network/privateEndpoints/write),
    enabling them to expose sensitive PaaS resources (Key Vault, Storage, SQL) to an in-VNet IP for lateral
    movement.'
  derived_from:
  - '<effective permission record: privateEndpoints/write>'