rage.fail

azure-vnet-private-endpoint-record

explicit azure emits PrivateReachability

match (record)

{ "field": "properties", "resource_type": "Microsoft.Network/privateEndpoints" }

where

properties.provisioningState == 'Succeeded' properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved' properties.privateDnsZoneGroups is defined (DNS resolution configured)

emit

source type	`PrivateEndpoint`
target type	`PrivateEndpoint`
source	`<private endpoint node>`
target	`<private endpoint node (self-edge; linked service via properties.privateLinkServiceConnections)>`

Narrative

Private endpoint {pe.name} makes {linkedService.name} privately reachable within VNet {vnet.name}.

Raw rule rules/explicit/azure-vnet.yaml

id: azure-vnet-private-endpoint-record
emits: PrivateReachability
applies_to:
- azure
match_record:
  resource_type: Microsoft.Network/privateEndpoints
  field: properties
where:
- properties.provisioningState == 'Succeeded'
- properties.privateLinkServiceConnections[].privateLinkServiceConnectionState.status == 'Approved'
- properties.privateDnsZoneGroups is defined (DNS resolution configured)
emit:
  source_type: PrivateEndpoint
  target_type: PrivateEndpoint
  source: <private endpoint node>
  target: <private endpoint node (self-edge; linked service via properties.privateLinkServiceConnections)>
  api_source: Microsoft.Network/privateEndpoints GET
  evidence_field: properties.subnet.id + properties.privateLinkServiceConnections + properties.privateDnsZoneGroups
  narrative: Private endpoint {pe.name} makes {linkedService.name} privately reachable within VNet {vnet.name}.