Firewall

Disable or modify the firewall's logging configuration, removing evidence of network traffic inspection, rule violations, and IPS alerts (cover tracks).

Swap the policy associated with a firewall to a permissive alternative, weakening or eliminating VPC traffic filtering (defense evasion).

Modify the firewall policy directly (change default action to PASS, remove blocking rule groups), weakening or eliminating VPC traffic filtering (defense evasion).

Modify or delete a customer-managed Network Firewall rule group to remove or corrupt 5-tuple/Suricata DROP/REJECT rules, opening traffic paths across all firewall policies that reference the group (defense evasion; blast radius scales with rule group reuse and RAM sharing).

A principal with ec2:CreateNetworkAclEntry, ec2:ReplaceNetworkAclEntry, or ec2:ReplaceNetworkAclAssociation can modify Network ACL rules, changing the firewall posture at the subnet level. This is a weaken-controls primitive for stateless packet filtering, complementary to security groups.

Deleting a WAF policy detaches it from all associated Application Gateways, removing all L7 filtering and reverting those gateways to Standard_v2 (WAF-less) behavior.

Writing a WAF policy on an Application Gateway allows switching the policy from Prevention to Detection mode (allowing all attacks through) or disabling managed rule sets, weakening L7 security for all backends behind the gateway.

Write access to the WAF policy object itself (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write) lets an attacker modify or delete managed rule sets and custom rules, effectively neutering WAF protections without touching the AFD profile or securityPolicies link.

Write access to AFD security policies (Microsoft.Cdn/profiles/securityPolicies/write) lets an attacker detach or replace the WAF policy linked to an AFD endpoint, removing bot protection, rate limiting, and custom detection rules from the public entry point.

Principal with the networkSecurityGroups/* wildcard (Network Contributor, Contributor, Owner) has full administrative control over the NSG.

An NSG effective inbound rule allows source=Internet (or 0.0.0.0/0) with action=Allow on a specific port - the firewall is open to the public internet for that port. CONDITIONAL(network_reachability): a public IP must also be present on an attached resource for the port to be externally reachable.

An NSG effective inbound Allow rule from Internet/0.0.0.0/0 on a service port, combined with a public IP (or internet-facing LB) on an attached resource, makes that resource internet-reachable: ExposedToInternet.

Principal with join/action on an NSG they control can re-associate (replace) the NSG on a target subnet or NIC, bypassing the original NSG's security rules. This is an NSG-specific escalation primitive that does not decompose into generic can-control or credential chains.

Principal with networkSecurityGroups/write can replace the full NSG rule set, including deleting all existing Deny rules - strictly stronger than securityRules/write alone.

Principal with securityRules/write can add an inbound Allow rule for Internet/0.0.0.0/0, opening previously blocked ports across all subnets and NICs where this NSG is associated.

A firewall rule allowing 0.0.0.0–255.255.255.255 explicitly exposes the Redis data-plane endpoint to the entire public internet.

SQL Managed Instance with publicDataEndpointEnabled=true and an NSG allowing inbound TCP 3342 from the internet is reachable by any internet host.

Allow Azure services rule (startIp=endIp=0.0.0.0) exposes the SQL server to all Azure tenants and multi-tenant services - not public internet but broad cross-tenant exposure.

SQL logical server with publicNetworkAccess=Enabled and a 0.0.0.0–255.255.255.255 firewall rule is reachable from the public internet on port 1433.

Write access to NSG security rules lets an attacker add an inbound allow rule (e.g., source=Any, port=*, action=Allow) to open previously blocked network paths.

Write access to the NSG object itself (create/replace) gives equivalent capability to rewrite all security rules, effectively bypassing any existing rule set.

Dataproc cluster master VM with a public IP and permissive dataproc-* firewall rules exposes the YARN UI / Spark History Server to the internet.

compute.firewalls.create lets an attacker insert an ALLOW rule, opening ports on any VMs matching a chosen tag or service account.

compute.firewalls.delete on a DENY rule lets an attacker unblock previously denied traffic, opening network access to matched VMs.

compute.organizations.setFirewallPolicy lets an attacker replace org/folder-level firewall policy, opening ports across all projects in scope.

compute.firewallPolicies.update on a hierarchical/network policy lets an attacker insert ALLOW rules affecting all projects in the policy scope.

compute.firewalls.update lets an attacker widen an existing rule to 0.0.0.0/0 source or add new ports.

An ingress firewall rule allowing 0.0.0.0/0 (or ::/0) on a specific port permits any internet host to initiate a connection to matching VMs on that port.

A source co-located with the destination in the same Subnet reaches it when the destination's SG/NSG/firewall admits the source segment on a listening port.

A source reaches a destination across a SINGLE VPC/VNet peering when the destination's ingress admits it - peering is non-transitive, so exactly one direct hop.

A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches the destination when its ingress rule admits the source.

A source reaches a destination through a shared transit hub (Transit Gateway/VWAN/NCC/Direct Connect gateway/VPN gateway) that forwards between attachments - transitive across the hub's associated route table.