azure-vnet-private-endpoint-fact
A private endpoint (emitted from explicit azure-vnet-private-endpoint-record) makes a PaaS service (Key Vault, Storage, SQL, Service Bus, etc.) reachable at a private VNet IP. Compute resources located in the endpoint's VNet (via LocatedIn edges) gain network-layer access to that service without traversing the internet.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'compute': None}
LocatedIn {'subnet': None}
{'subnet': None} LocatedIn {'vnet': None}
{'privateEndpoint': None} PrivateReachability {'paaService': None}
{'privateEndpoint': None} AttachedTo {'peSubnet': None}
{'peSubnet': None} LocatedIn {'peVNet': None}
where
?vnet == ?peVNet OR ?vnet.
PeeredWith(?peVNet) (compute VNet is same or peered with PE VNet)
no effective NSG rule on ?peSubnet or ?compute's NIC blocks traffic to the PE's private IP
emit
| source type | Compute |
|---|---|
| target type | PrivateEndpoint |
| source | ?compute |
| target | ?privateEndpoint |
| conditions | network_reachability |
| state logic | CONDITIONAL(network_reachability): the private endpoint exists and DNS resolves within the VNet, but actual reachability from ?compute requires (1) ?compute in same VNet as PE or in a peered VNet, (2) no NSG blocking the PE's private IP, (3) PaaS resource firewall rules include the PE's subnet/VNet (check networkAcls). Emit ACTIVE only when all conditions are confirmed. |
Narrative
Private endpoint {target.name} makes service {linkedService.name} reachable at a private IP in VNet {peVNet.name}; {source.name} located in that VNet (or a peered VNet) can reach it without an internet path.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-private-endpoint-fact
emits: PrivateReachability
description: A private endpoint (emitted from explicit azure-vnet-private-endpoint-record) makes a PaaS
service (Key Vault, Storage, SQL, Service Bus, etc.) reachable at a private VNet IP. Compute resources
located in the endpoint's VNet (via LocatedIn edges) gain network-layer access to that service without
traversing the internet.
match:
- - compute: null
- LocatedIn
- subnet: null
- - subnet: null
- LocatedIn
- vnet: null
- - privateEndpoint: null
- PrivateReachability
- paaService: null
- - privateEndpoint: null
- AttachedTo
- peSubnet: null
- - peSubnet: null
- LocatedIn
- peVNet: null
where:
- ?vnet == ?peVNet OR ?vnet.PeeredWith(?peVNet) (compute VNet is same or peered with PE VNet)
- no effective NSG rule on ?peSubnet or ?compute's NIC blocks traffic to the PE's private IP
emit:
source_type: Compute
target_type: PrivateEndpoint
source: ?compute
target: ?privateEndpoint
permissions: []
conditions:
- network_reachability
state_logic: 'CONDITIONAL(network_reachability): the private endpoint exists and DNS resolves within
the VNet, but actual reachability from ?compute requires (1) ?compute in same VNet as PE or in a peered
VNet, (2) no NSG blocking the PE''s private IP, (3) PaaS resource firewall rules include the PE''s
subnet/VNet (check networkAcls). Emit ACTIVE only when all conditions are confirmed.'
derived_from:
- azure-vnet-private-endpoint-record
- LocatedIn(Compute->Subnet)
- LocatedIn(Subnet->VNet)
- LocatedIn(Subnet->VNet) for PE
false_positive_note: "A private endpoint with provisioningState != Succeeded or connection status !=\
\ Approved is NOT active; do not emit. Service-level firewall rules on the PaaS resource (e.g., Storage\
\ Account networkAcls.bypass) may still block access even over private endpoints if the resource does\
\ not list the PE's subnet. Confirm the resource's network rules include the PE's VNet/subnet or allow\
\ all virtual networks. Private endpoint networking is layer-3; the PaaS resource's own auth (RBAC,\
\ SAS, etc.) is still required \u2014 PrivateReachability gates network access, not data-plane auth."
narrative: Private endpoint {target.name} makes service {linkedService.name} reachable at a private
IP in VNet {peVNet.name}; {source.name} located in that VNet (or a peered VNet) can reach it without
an internet path.