PrivateReachability
Reachable only via private networking (PrivateLink/PE/PSC) - needs a foothold in-network. Includes private APIs and messaging endpoints accessible only via interface endpoints, and object storage reached via a private/gateway endpoint (Azure Blob/Files PE, GCS via PSC). Network sources cover the endpoint/distribution itself acting as the reachability actor (e.g. a CloudFront distribution's OAC/OAI reaching a private S3 origin, or a Private Endpoint node).
Compute, Messaging, Network
── PrivateReachability ──▸
Data, PrivateEndpoint, Compute, Storage
Source types
ComputeMessagingNetworkTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | derived |
|---|
Rules that emit PrivateReachability 19
A CloudFront distribution configured with OAC or OAI on an S3 origin can reach a private (non-public) S3 bucket on behalf of viewers. The distribution acts as a controlled gateway to otherwise-private data.
awsderived
An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Source is any Compute node in the VPC that has network access to the endpoint ENI.
awsderived
An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Derived from the endpoint state and VPC co-location facts.
awsderived
A ServiceNetworkResourceAssociation with status ACTIVE grants PrivateReachability from connected-VPC clients to the resource through the resource gateway.
awsderived
An AFD Premium origin configured with a sharedPrivateLinkResource makes the target PaaS service reachable via a private endpoint inside the customer VNet. A compute foothold in the same VNet as the PE subnet can reach the same service privately (without traversing the internet).
azurederived
An Approved private endpoint with a working private DNS zone group makes the backing PaaS resource (Key Vault, Storage, SQL, etc.) reachable at a private IP from any compute in the same VNet or a peered VNet - bypassing the public firewall.
azurederived
An Approved private endpoint connection that crosses subscription boundaries extends private network reach across the subscription boundary: a foothold in the consumer VNet (sub A) gains private network access to the PaaS resource in the provider subscription (sub B).
azurederived
When a consumer PE is Approved and connected to an attacker-controlled Private Link Service, network traffic from the consumer VNet is routed to the attacker's backend. This models the realized traffic-interception attack scenario (distinct from the write capability).
azurederived
A private endpoint (emitted from explicit azure-vnet-private-endpoint-record) makes a PaaS service (Key Vault, Storage, SQL, Service Bus, etc.) reachable at a private VNet IP. Compute resources located in the endpoint's VNet (via LocatedIn edges) gain network-layer access to that service without traversing the internet.
azurederived
A function with a VPC connector can reach private resources; code running in it moves laterally into the VPC.
gcpderived
An internal Application Load Balancer or internal passthrough NLB (loadBalancingScheme INTERNAL or INTERNAL_MANAGED) is reachable only from within the VPC, peered VPCs, or connected on-premises networks. A compute resource with a foothold in the same VPC can reach the internal LB frontend and, through it, the backends.
gcpderived
A PSC consumer forwarding rule targeting the all-apis or vpc-sc Google API bundle gives workloads in the consumer VPC private IP access to Google APIs (Cloud Storage, Secret Manager, BigQuery, etc.) without a public IP or internet egress. An in-network attacker with code running on a consumer-VPC workload can call any Google API the workload's SA is permitted to call over this private path.
gcpderived
A PSC consumer forwarding rule targeting a Service Attachment (producer-published service) gives workloads in the consumer VPC private IP access to the producer's Internal Load Balancer backend (Cloud SQL, Cloud Run, GCE-based service, etc.). An in-network attacker can reach the producer backend over this private channel without traversing the public internet.
gcpderived
A Private Service Connect consumer endpoint (forwarding rule targeting a serviceAttachment) provides a private internal-IP path from the consumer VPC to the producer service, without internet traversal.
gcpderived
azureexplicit
A Microsoft.Network/privateEndpoints ARM record with provisioningState=Succeeded, connection status=Approved, and a privateDnsZoneGroup attachment directly establishes that the backing PaaS resource is privately reachable from compute in the same or peered VNet. This is a structural fact observed in the PE resource properties.
azureexplicit
A Microsoft.Network/privateEndpoints ARM record where the PE subscription differs from the backing resource's subscription (cross-subscription connection) directly establishes cross-subscription private reachability. The connection is approved and DNS-configured, so network traffic flows across the subscription boundary.
azureexplicit
If the backing PaaS resource (Key Vault, Storage, etc.) has a non-empty autoApprovalSubIds list in its privateEndpointConnections properties, and a PE is created in a subscription matching that list, the connection is auto-approved (no manual approval step required). Creating a PE in that subscription immediately grants the consumer VNet private access to the resource.
azureexplicit
azureexplicit