LoadBalancer

A principal with CreateLoadBalancer + CreateListener + CreateTargetGroup + RegisterTargets + EC2 read/write perms can create a new internet-facing ALB or NLB, exposing any registered backend to the public internet. Emit CanCreate(Identity -> LoadBalancer) as a POTENTIAL escalation premise; ExposedToInternet fires on the resulting LB.

Modify an ALB listener whose default action includes authenticate-oidc or authenticate-cognito to remove or replace the authentication action, bypassing application-layer identity enforcement before traffic reaches the backend.

Modify an ALB listener rule whose actions include authenticate-oidc or authenticate-cognito to bypass per-path authentication enforced by that rule.

An ALB or NLB listener with a forward action creates a network path from the LB to its backend targets (instances/IPs/ALBs). This is a CONDITIONAL(network_reachability) fact - the LB SG must allow inbound AND the backend SG must allow inbound from the LB's SG/IP range.

Replace the security groups on an ALB or CLB with a permissive one to open inbound access from any source to the load balancer (network gate weakening).

A DEPLOYED Global Accelerator with anycast IPs enabled is internet-reachable. This rule derives the exposure fact from the normalizer's structural Accelerator node.

A principal with globalaccelerator:UpdateEndpointGroup or globalaccelerator:AddEndpoints can redirect internet-bound anycast traffic to a different or attacker-influenced endpoint within the account (traffic hijack / defense evasion).

An active Endpoint Group with healthy endpoints forwards traffic from the accelerator to each endpoint. Emits CanNetworkReach CONDITIONAL on network reachability, per Phase 8 discipline for per-service network facts.

Holding Microsoft.Network/applicationGateways/* grants full control of an Application Gateway including routing rules, SSL certs, WAF policy, and backend pools.

An attacker who can write an Application Gateway and pass a user-assigned MI can swap the gateway's identity, gaining that MI's Key Vault (and potentially broader) permissions.

An Application Gateway with a public frontend IP accepts HTTP/HTTPS traffic from the internet on its listener ports.

Writing an Application Gateway allows an attacker to redirect routing rules to attacker-controlled backends, swap SSL certificates, or modify the WAF policy binding - all without touching the backend VMs.

Write access to the AFD profile object (Microsoft.Cdn/profiles/*) grants full control: endpoints, origin groups, origins, security policies, WAF links, rule sets, and custom domains.

Holding the Microsoft.Network/loadBalancers/* wildcard grants full control of a Standard Load Balancer.

Writing a Load Balancer backend address pool allows adding an attacker-controlled VM to the pool, routing a fraction of traffic to it for interception or amplification.

Creating or modifying an inbound NAT rule maps a public LB frontend port directly to a backend VM's port, potentially exposing SSH/RDP/admin ports to the internet.

A Standard Load Balancer with a public frontend IP is reachable from the internet on its listener ports.

Writing a Load Balancer resource allows adding a public frontend IP, new load-balancing rules, or inbound NAT rules that expose previously private ports.

A principal with compute.backendServices.update can set iap.enabled=false on a backend service that currently has IAP enabled, disabling the authentication gate. If the backend service is internet-facing (via an external HTTPS load balancer), this immediately exposes the protected application to unauthenticated internet access. This is a weaken-control primitive: IAP removal + internet-facing LB = ExposedToInternet on the backend app.

Holding compute.loadBalancerAdmin-equivalent permissions (roles/compute.loadBalancerAdmin or roles/compute.networkAdmin / roles/compute.admin) grants full create/update/delete control over all Cloud Load Balancing resources: forwarding rules, target proxies, URL maps, backend services, NEGs, health checks, SSL certificates.

compute.backendServices.update allows modifying backend service configuration, including adding/removing Network Endpoint Groups (NEGs) from the backend pool and changing load-balancing configuration. An attacker can add a serverless NEG pointing to an attacker-controlled Cloud Run service to intercept a fraction of traffic. NOTE: disabling IAP (iap.enabled=false) is the canonical case covered by gcp-iap-disable-on-backend-service in iap.yaml - this rule focuses on the backend-pool mutation sub-case.

A global or regional external forwarding rule with a public IP (loadBalancingScheme EXTERNAL or EXTERNAL_MANAGED) is reachable from the public internet on its configured port. IAP on backend services is an authentication layer but does not remove the internet-exposure fact.

compute.backendServices.setIamPolicy rewrites the IAP resource-level allow policy on a backend service. Granting roles/iap.httpsResourceAccessor to allUsers bypasses IAP authentication - all requests pass through without a Google identity - without setting iap.enabled=false, so monitoring / logs show IAP still "enabled" while access is open.

compute.globalForwardingRules.setTarget (or compute.forwardingRules.setTarget for regional) changes the target proxy of an existing forwarding rule. An attacker can re-point a public IP at an attacker-controlled target proxy/backend service, intercepting all traffic for the forwarding rule's hostname without touching the original backend or changing DNS.

compute.targetHttpsProxies.setUrlMap (or compute.targetHttpProxies.setUrlMap) changes the URL map bound to an existing target proxy. An attacker can swap the URL map without touching the forwarding rule, redirecting all traffic through the target proxy to an attacker-controlled URL map and backend service. This achieves traffic hijack and IAP bypass without requiring setTarget on the forwarding rule.

compute.urlMaps.update (global URL maps) and compute.regionUrlMaps.update (regional URL maps) rewrite host rules, path matchers, and default service. An attacker can redirect specific paths or entire hostnames to attacker-controlled backend services, intercept decrypted application traffic, or route paths to a backend service NOT protected by IAP (bypassing authentication on those paths while leaving IAP visually enabled on the URL map).

A forwarding rule with loadBalancingScheme EXTERNAL and an assigned external IP exposes the backend service to the public internet.

An internet principal that can reach an internet-facing load balancer can also reach the LB's backend targets - composing internet-entry with LB-to-backend forwarding.