Derivation rules

A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.

WebServer-tier environments front instances with an internet-facing ELB by default.

A Deployed CloudFront distribution is publicly reachable from the internet on its *.cloudfront.net domain (and any custom CNAME aliases).

An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.

A DocumentDB cluster with PubliclyAccessible=true and a VPC security group permitting inbound TCP 27017 from 0.0.0.0/0 or ::/0 is network-reachable from the public internet. Valid MongoDB credentials (obtained via credential-grab paths) enable connection without VPC foothold.

DocumentDB cluster snapshot is publicly restorable (restore attribute contains 'all') via rds:DescribeDBClusterSnapshotAttributes.

An EventBridge custom bus policy granting events:PutEvents to Principal '*' is publicly writable; any internet actor can inject events and potentially trigger compute consumers.

A principal with ec2:ModifySnapshotAttribute can make a snapshot world-readable (any AWS account can CreateVolume from it).

A public ECR repository is pull-accessible to any user on the internet without authentication, enabling supply-chain poisoning by external/anonymous attackers.

A DEPLOYED Global Accelerator with anycast IPs enabled is internet-reachable. This rule derives the exposure fact from the normalizer's structural Accelerator node.

Function URL with AuthType NONE + public resource policy is internet-invocable.

An Amazon MQ broker with PubliclyAccessible=true is reachable from the internet over wire-protocol ports; obtaining broker credentials is sufficient to publish messages and trigger bound Lambda consumers.

An MSK cluster with publiclyAccessible enabled and an open broker security group (port 9198 from 0.0.0.0/0) is internet-reachable; IAM or SASL/SCRAM authentication still required.

Neptune DB instance with a public endpoint, permissive security group (port 8182/8183/8184 from 0.0.0.0/0), and IAM database authentication disabled is accessible from the internet without any credential.

Neptune cluster snapshot with public restore attribute (restore=all) is immediately exfiltrable by any AWS account via RestoreDBClusterFromSnapshot.

Neptune cluster snapshot with public restore attribute (restore=all) is exposed to the internet via CrossAccountTrust to external Account.

OpenSearch domain with a public endpoint and Principal:* access policy is reachable from the internet; unauthenticated if FGAC is also disabled.

A Redshift cluster or Serverless workgroup with PubliclyAccessible=true and a permissive VPC security group is reachable from the public internet on port 5439.

A dangling alias or CNAME record pointing to a deprovisioned AWS resource enables subdomain takeover - an attacker (unauthenticated, from the internet) claims the deprovisioned resource and serves content on the hijacked name without any AWS IAM permission required.

s3:PutBucketPublicAccessBlock + s3:PutBucketPolicy enables a two-step escalation to expose the bucket - attacker CAN expose the bucket but it is NOT currently exposed.

S3 bucket with a Principal:* bucket policy allowing s3:GetObject and Block Public Access disabled (RestrictPublicBuckets=false) is readable by any internet client.

s3:PutBucketAcl on a bucket with ObjectOwnership != BucketOwnerEnforced and Block Public Access IgnorePublicAcls=false enables ACL-based public exposure.

S3 static website hosting publishes a public HTTP endpoint serving bucket objects, independent of the bucket policy's API access controls.

An SNS topic access policy granting sns:Publish to Principal '*' is internet-accessible - anyone can publish and trigger all subscribers.

An SQS queue with Principal:* granting sqs:SendMessage (no condition) is publicly writable; any unauthenticated sender can trigger bound Lambda consumers via messaging-chains.

A compute resource is internet-exposed when its security group has an inbound rule allowing 0.0.0.0/0 (or ::/0) on a port, the resource has a public IP, and the subnet has a route to an Internet Gateway. All three conditions must be observed facts.

Container group with a public IP and exposed ports.

anonymousPullEnabled == true on a registry makes image pull accessible to any unauthenticated client from the internet.

An ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com + management.azure.com) to the internet.

ADLS Gen2 account with public blob access enabled and a public container exposes blob data to unauthenticated internet access.

AML online endpoint with a public HTTPS URL and key-based auth is reachable from the internet; the scoring key is retrievable via listkeys.

AML workspace with publicNetworkAccess=Enabled exposes its management REST API to the internet - any token holder can reach it.

An Application Gateway with a public frontend IP accepts HTTP/HTTPS traffic from the internet on its listener ports.

App Service site reachable from the public internet on its default/custom hostname or scm endpoint.

An enabled Automation Account webhook with a public URI is internet-triggerable; any holder of the URI can start a runbook job.

Container App with external ingress and no denying IP restrictions.

Cosmos DB account with no IP firewall and public network access enabled exposes its data-plane endpoint to the internet - any caller with a valid token can reach it.

Databricks workspace REST API endpoint is publicly reachable; any token/PAT holder can authenticate from the internet.

A CNAME or A/AAAA alias DNS record in a public Azure DNS zone pointing to a deprovisioned Azure resource enables subdomain takeover: an external attacker can claim that resource name and inherit DNS resolution for the dangling hostname.

An Event Hubs namespace with no IP/VNet network restrictions and publicNetworkAccess not Disabled is internet-reachable; any holder of SAS or Entra data-plane credentials can access it from the internet.

An Event Grid custom topic with publicNetworkAccess=Enabled is internet-accessible for event publishing (any holder of the topic key can publish from the internet).

When an Azure Firewall has active DNAT rules and a public IP allocated, resources translated by those rules are exposed to the internet via the firewall's public endpoint. This is emitted as internet exposure on the firewall node itself (as a Network class that has public reachability).

An enabled Azure Front Door endpoint (*.azurefd.net or a custom domain) is reachable from the public internet by design - AFD uses Microsoft's global anycast infrastructure; no explicit public IP is required on the profile. This is derived from the explicit normalization rule azure-frontdoor-endpoint-record.

A Function app with a public hostname and an anonymous-auth HTTP trigger.