PublicEndpoint

A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.

A principal with cloudfront:CreateDistribution can create new distributions pointing at any origin (S3 bucket, ALB, API Gateway, custom endpoint). If an S3 bucket has an overly-broad OAC policy grant (missing aws:SourceArn condition), the attacker can create a distribution to expose its contents publicly.

A Deployed CloudFront distribution is publicly reachable from the internet on its *.cloudfront.net domain (and any custom CNAME aliases).

A principal with cloudfront:UpdateDistribution can change origins, behaviors, WAF association, Lambda@Edge bindings, HTTPS policy, OAC/OAI, and trusted signers - altering the effective network posture and access controls of the distribution.

An enabled Azure Front Door endpoint (*.azurefd.net or a custom domain) is reachable from the public internet by design - AFD uses Microsoft's global anycast infrastructure; no explicit public IP is required on the profile. This is derived from the explicit normalization rule azure-frontdoor-endpoint-record.

Write access to AFD origin configuration (Microsoft.Cdn/profiles/originGroups/origins/write) lets an attacker replace an origin's hostname with an attacker-controlled server, causing AFD to forward real user requests (with authentication headers and session cookies) to attacker infrastructure.

An enabled AFD routing rule (route) linking a front door endpoint to an origin group with at least one enabled origin is a RoutesTo fact: the AFD route object (generic_type: Route, provider_type: Microsoft.Cdn/profiles/afdEndpoints/routes) routes matched internet requests to that origin resource. This is derived from the explicit normalization rule azure-frontdoor-origin-record.

A CNAME or alias DNS record (in a public zone) pointing to a deprovisioned Azure resource enables subdomain takeover: an attacker can claim the target resource and inherit DNS resolution for the dangling name.

A compute resource or load balancer with a public IP AND an NSG rule that allows inbound Internet/0.0.0.0/0 on a port is internet-exposed.

A serving App Engine version is reachable at its appspot.com URL (modeled as a PublicEndpoint node) unless ingress-restricted.

A principal with compute.backendServices.update can set iap.enabled=false on a backend service that currently has IAP enabled, disabling the authentication gate. If the backend service is internet-facing (via an external HTTPS load balancer), this immediately exposes the protected application to unauthenticated internet access. This is a weaken-control primitive: IAP removal + internet-facing LB = ExposedToInternet on the backend app.

A principal with iap.webServiceVersions.accessViaIAP (or parent-level iap.webTypes.accessViaIAP / iap.web.accessViaIAP) can reach an IAP-protected web application (App Engine, Cloud Run, GKE Ingress, or backend service via HTTPS LB) after authenticating through Google IAP. This provides network-level reach to the backend application, though the backend's own authorization layer may further gate access.