network-private-link-reach
A private-link/PSC/private-endpoint path makes a PaaS/data/storage service reachable to an in-network consumer, often across account/project boundaries without internet exposure.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?src) in [Compute, Network, Messaging]
node_class(?dst) in [Data, Network, Compute, Storage]
emit
| source type | Compute Network Messaging |
|---|---|
| target type | Data Network Compute Storage |
| source | ?src |
| target | ?dst |
| conditions | network_reachability |
| state logic | Inherit the PrivateReachability state directly. ACTIVE when the private endpoint / PSC endpoint / PrivateLink is provisioned and approved, the consumer has a foothold in the endpoint's VNet/subnet, AND the endpoint SG is confirmed to admit the source. CONDITIONAL(network_reachability) when the in-network foothold is unproven or the endpoint SG has not been evaluated (the private path requires being inside the consumer network — it is not internet-reachable). BLOCKED if the endpoint is not in an approved/available state. |
Narrative
{dst.name} is privately reachable from {src.name} over a PrivateLink/PSC/private endpoint; an in-network foothold reaches it directly, crossing any account/project boundary without touching the internet.
Raw rule rules/derived/network-chains.yaml
id: network-private-link-reach
emits: CanNetworkReach
description: A private-link/PSC/private-endpoint path makes a PaaS/data/storage service reachable to an
in-network consumer, often across account/project boundaries without internet exposure.
applies_to:
- '*'
match:
- - src: null
- PrivateReachability
- dst: null
where:
- node_class(?src) in [Compute, Network, Messaging]
- node_class(?dst) in [Data, Network, Compute, Storage]
emit:
source_type:
- Compute
- Network
- Messaging
target_type:
- Data
- Network
- Compute
- Storage
source: ?src
target: ?dst
permissions: []
conditions:
- network_reachability
state_logic: "Inherit the PrivateReachability state directly. ACTIVE when the private endpoint / PSC\
\ endpoint / PrivateLink is provisioned and approved, the consumer has a foothold in the endpoint's\
\ VNet/subnet, AND the endpoint SG is confirmed to admit the source. CONDITIONAL(network_reachability)\
\ when the in-network foothold is unproven or the endpoint SG has not been evaluated (the private\
\ path requires being inside the consumer network \u2014 it is not internet-reachable). BLOCKED if\
\ the endpoint is not in an approved/available state."
confidence: min(contributing_confidences)
derived_from:
- ?src PrivateReachability ?dst
false_positive_note: "A private endpoint is reachable ONLY from inside its VNet/subnet (or a peered/routed\
\ segment) \u2014 it is not an internet path; do not conflate with rule 5. Its lateral-movement value\
\ is that it crosses account/project/subscription boundaries WITHOUT the internet: a foothold in the\
\ consumer network reaches the provider's PaaS resource directly. The cross-boundary AUTHORIZATION\
\ (an approved cross-subscription PE connection) is a CrossAccountTrust fact owned by the adapter,\
\ not re-derived here. Storage targets (Azure Blob, Azure Files, GCS) are included because Private\
\ Endpoints / PSC commonly front these services; the PrivateReachability schema extension is required\
\ to formally cover Storage targets in edges.yaml."
narrative: '{dst.name} is privately reachable from {src.name} over a PrivateLink/PSC/private endpoint;
an in-network foothold reaches it directly, crossing any account/project boundary without touching
the internet.'