network-lb-proxy-reach

An internet principal that can reach an internet-facing load balancer can also reach the LB's backend targets - composing internet-entry with LB-to-backend forwarding.

derived any cloud emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Compute` `Data` `Storage` `Network`
source	`?anon`
target	`?backend`
conditions	`network_reachability`
state logic	CONDITIONAL(network_reachability): the LB's own listener admission rule (port/protocol match, target group health check) and the backend's SG must both be confirmed before upgrading to ACTIVE. Inherit the weakest of the two contributing CanNetworkReach edges. BLOCKED if a WAF / authentication action (OIDC, Cognito, Cloud Armor, App GW WAF policy) demonstrably blocks unauthenticated internet traffic before it reaches the backend.

source type

Identity

target type

Compute Data Storage Network

source

?anon

target

?backend

conditions

network_reachability

state logic

CONDITIONAL(network_reachability): the LB's own listener admission rule (port/protocol match, target group health check) and the backend's SG must both be confirmed before upgrading to ACTIVE. Inherit the weakest of the two contributing CanNetworkReach edges. BLOCKED if a WAF / authentication action (OIDC, Cognito, Cloud Armor, App GW WAF policy) demonstrably blocks unauthenticated internet traffic before it reaches the backend.

Narrative

{anon.name} can reach load balancer {lb.name} from the internet, and {lb.name} forwards to {backend.name} - providing a transitive network path from the internet to the backend target.

Raw rule rules/derived/network-chains.yaml

id: network-lb-proxy-reach
emits: CanNetworkReach
description: "An internet principal that can reach an internet-facing load balancer can also reach the\
  \ LB's backend targets \u2014 composing internet-entry with LB-to-backend forwarding."
applies_to:
- '*'
match:
- - anon: null
  - CanNetworkReach
  - lb: null
- - lb: null
  - CanNetworkReach
  - backend: null
where:
- node_class(?anon) == Identity
- node_type(?lb) == LoadBalancer
- node_class(?backend) in [Compute, Data, Storage, Network]
- state(?anon, CanNetworkReach, ?lb) != BLOCKED
- state(?lb, CanNetworkReach, ?backend) != BLOCKED
emit:
  source_type: Identity
  target_type:
  - Compute
  - Data
  - Storage
  - Network
  source: ?anon
  target: ?backend
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability): the LB''s own listener admission rule (port/protocol
    match, target group health check) and the backend''s SG must both be confirmed before upgrading to
    ACTIVE. Inherit the weakest of the two contributing CanNetworkReach edges. BLOCKED if a WAF / authentication
    action (OIDC, Cognito, Cloud Armor, App GW WAF policy) demonstrably blocks unauthenticated internet
    traffic before it reaches the backend.'
  confidence: min(contributing_confidences)
  derived_from:
  - ?anon CanNetworkReach ?lb
  - ?lb CanNetworkReach ?backend
  false_positive_note: "The LB's own listener admission (ALB listener rules, target group routing, NLB\
    \ protocol/port match) and the backend's SG/NSG are separate gates from network reachability \u2014\
    \ this rule asserts the NETWORK PATH only. An ALB with an authenticate-oidc or authenticate-cognito\
    \ action, an App Gateway with a WAF policy blocking unauthenticated requests, or a Cloud Armor policy\
    \ with preconfigured WAF rules are real controls that cap this edge to BLOCKED for unauthenticated\
    \ internet traffic. Emit CONDITIONAL until all gates are confirmed."
  narrative: "{anon.name} can reach load balancer {lb.name} from the internet, and {lb.name} forwards\
    \ to {backend.name} \u2014 providing a transitive network path from the internet to the backend target."