azure Dialect

Version and compatibility

Version: 0.1.0.

Provider bindings and declared compatibility

• azure/azapi: = 2.12.0.
• hashicorp/azuread: = 3.9.0.
• hashicorp/azurerm: = 5.3.0.

All official Dialects

Interpreted types

Each row identifies a type and instance kind. Conditional Rules retain their individual conditions in the details below.

Terraform type	Kind	Classification	Rules
azapi_resource	resource	azure-enclave managed-database sre-agent	azure-enclave (conditional) horizondb-cluster (conditional) sre-agent (conditional)
azuread_access_package_assignment_policy	resource	identity-governance-detail	entra-access-package-assignment-policy
azuread_app_role_assignment	resource	identity-governance-detail	entra-app-role-assignment
azuread_application_federated_identity_credential	resource	identity-governance-detail	entra-application-federated-identity
azuread_application_registration	resource	entra-application	entra-application-registration
azuread_application	resource	entra-application	entra-application
azuread_authentication_strength_policy	resource	identity-governance-detail	entra-authentication-strength-policy
azuread_group_without_members	resource	identity-group	entra-group-without-members
azuread_group	resource	identity-group	entra-group
azuread_named_location	resource	identity-governance-detail	entra-named-location
azuread_service_principal	resource	service-identity	entra-service-principal
azurerm_aadb2c_directory	resource	entra-directory	entra-external-id-directory
azurerm_active_directory_domain_service_replica_set	resource	identity-governance-detail	entra-domain-services-replica-set
azurerm_active_directory_domain_service_trust	resource	identity-governance-detail	entra-domain-services-trust
azurerm_active_directory_domain_service	resource	entra-domain-service	entra-domain-services
azurerm_advanced_threat_protection	resource	security-detail	advanced-threat-protection
azurerm_ai_foundry_project	resource	ai-foundry	ai-foundry-project
azurerm_ai_foundry	resource	ai-foundry	ai-foundry
azurerm_analysis_services_server	resource	analytics-cluster	analysis-services-server
azurerm_api_connection	resource	integration-connection	api-connection
azurerm_api_management_api	resource	api-management-detail	api-management-api
azurerm_api_management_backend	resource	api-management-detail	api-management-backend
azurerm_api_management_gateway	resource	api-management-detail	api-management-gateway
azurerm_api_management_policy	resource	api-management-detail	api-management-policy
azurerm_api_management_product	resource	api-management-detail	api-management-product
azurerm_api_management_standalone_gateway	resource	api-gateway	api-management-standalone-gateway
azurerm_api_management_workspace	resource	api-management-detail	api-management-workspace
azurerm_api_management	resource	api-gateway	api-management
azurerm_app_configuration	resource	app-configuration	app-configuration
azurerm_app_service_connection	resource	integration-connection	app-service-connection
azurerm_app_service_environment_v3	resource	app-service-environment	app-service-environment
azurerm_application_gateway	resource	load-balancer	application-gateway
azurerm_application_insights_standard_web_test	resource	operations-detail	application-insights-web-test
azurerm_application_insights	resource	application-insights	application-insights
azurerm_application_load_balancer_frontend	resource	load-balancer-component	application-load-balancer-frontend
azurerm_application_load_balancer	resource	load-balancer	application-load-balancer
azurerm_application_security_group	resource	network-policy-detail	application-security-group
azurerm_arc_kubernetes_cluster	resource	kubernetes-cluster	arc-kubernetes-cluster
azurerm_arc_kubernetes_provisioned_cluster	resource	kubernetes-cluster	arc-provisioned-kubernetes-cluster
azurerm_arc_machine	resource	arc-enabled-server	arc-enabled-server
azurerm_arc_private_link_scope	resource	private-link-scope	arc-private-link-scope
azurerm_arc_resource_bridge_appliance	resource	arc-resource-bridge	arc-resource-bridge
azurerm_attestation_provider	resource	attestation-provider	attestation-provider
azurerm_automation_account	resource	automation-account	automation-account
azurerm_automation_runbook	resource	workflow	automation-runbook
azurerm_automation_schedule	resource	operations-detail	automation-schedule
azurerm_availability_set	resource	compute-placement	availability-set
azurerm_backup_policy_file_share	resource	backup-plan	file-share-backup-policy
azurerm_backup_policy_vm	resource	backup-plan	virtual-machine-backup-policy
azurerm_backup_protected_vm	resource	site-recovery-detail	backup-protected-vm
azurerm_bastion_host	resource	bastion-host	bastion-host
azurerm_batch_account	resource	batch-account	batch-account
azurerm_batch_application	resource	batch-pool	batch-application
azurerm_batch_pool	resource	batch-pool	batch-pool
azurerm_bot_channels_registration	resource	bot-service	bot-channels-registration
azurerm_bot_service_azure_bot	resource	bot-service	azure-bot
azurerm_bot_web_app	resource	bot-service	bot-web-app
azurerm_capacity_reservation_group	resource	compute-placement	capacity-reservation-group
azurerm_capacity_reservation	resource	compute-placement	capacity-reservation
azurerm_cdn_endpoint	resource	content-delivery-profile	cdn-endpoint
azurerm_cdn_frontdoor_endpoint	resource	load-balancer-component	front-door-endpoint
azurerm_cdn_frontdoor_origin_group	resource	load-balancer-component	front-door-origin-group
azurerm_cdn_frontdoor_origin	resource	load-balancer-component	front-door-origin
azurerm_cdn_frontdoor_profile	resource	front-door-profile	front-door-profile
azurerm_cdn_frontdoor_route	resource	load-balancer-component	front-door-route
azurerm_cdn_profile	resource	content-delivery-profile	cdn-profile
azurerm_chaos_studio_experiment	resource	chaos-experiment	chaos-studio-experiment
azurerm_cognitive_account_project	resource	ai-foundry	ai-services-project
azurerm_cognitive_account	resource	ai-service-account	ai-services-account
azurerm_cognitive_deployment	resource	ai-inference-endpoint	ai-model-deployment
azurerm_communication_service	resource	communication-service	communication-service
azurerm_confidential_ledger	resource	confidential-ledger	confidential-ledger
azurerm_container_app_environment	resource	container-app-environment	container-app-environment
azurerm_container_app_job	resource	container-app-job	container-app-job
azurerm_container_app	resource	container-app	container-app
azurerm_container_connected_registry	resource	container-registry	connected-container-registry
azurerm_container_group	resource	container-instance-group	container-instance-group
azurerm_container_registry	resource	container-registry	container-registry
azurerm_cosmosdb_account	resource	cosmos-account	cosmos-account
azurerm_cosmosdb_cassandra_cluster	resource	managed-database	cosmos-cassandra-cluster
azurerm_cosmosdb_cassandra_keyspace	resource	logical-database	cosmos-cassandra-keyspace
azurerm_cosmosdb_cassandra_table	resource	database-component	cosmos-cassandra-table
azurerm_cosmosdb_gremlin_database	resource	logical-database	cosmos-gremlin-database
azurerm_cosmosdb_gremlin_graph	resource	database-component	cosmos-gremlin-graph
azurerm_cosmosdb_mongo_collection	resource	database-component	cosmos-mongo-collection
azurerm_cosmosdb_mongo_database	resource	logical-database	cosmos-mongo-database
azurerm_cosmosdb_postgresql_cluster	resource	managed-database	cosmos-postgresql-cluster
azurerm_cosmosdb_sql_container	resource	database-component	cosmos-sql-container
azurerm_cosmosdb_sql_database	resource	logical-database	cosmos-sql-database
azurerm_cosmosdb_sql_dedicated_gateway	resource	database-component	cosmos-dedicated-gateway
azurerm_custom_ip_prefix	resource	public-address	custom-ip-prefix
azurerm_dashboard_grafana	resource	managed-grafana	managed-grafana
azurerm_data_factory_data_flow	resource	data-integration-detail	data-factory-data-flow
azurerm_data_factory_dataset_azure_blob	resource	data-integration-detail	data-factory-blob-dataset
azurerm_data_factory_dataset_azure_sql_table	resource	data-integration-detail	data-factory-sql-dataset
azurerm_data_factory_integration_runtime_azure	resource	data-integration-runtime	data-factory-azure-integration-runtime
azurerm_data_factory_integration_runtime_self_hosted	resource	data-integration-runtime	data-factory-self-hosted-integration-runtime
azurerm_data_factory_linked_service_azure_blob_storage	resource	data-integration-detail	data-factory-blob-linked-service
azurerm_data_factory_linked_service_azure_sql_database	resource	data-integration-detail	data-factory-sql-linked-service
azurerm_data_factory_managed_private_endpoint	resource	data-integration-detail	data-factory-managed-private-endpoint
azurerm_data_factory_pipeline	resource	workflow	data-factory-pipeline
azurerm_data_factory_trigger_schedule	resource	data-integration-detail	data-factory-schedule-trigger
azurerm_data_factory	resource	data-factory	data-factory
azurerm_data_protection_backup_policy_blob_storage	resource	backup-plan	data-protection-blob-backup-policy
azurerm_data_protection_backup_policy_disk	resource	backup-plan	data-protection-disk-backup-policy
azurerm_data_protection_backup_vault	resource	backup-vault	data-protection-backup-vault
azurerm_data_share_account	resource	data-share-account	data-share-account
azurerm_database_migration_project	resource	migration-service	database-migration-project
azurerm_database_migration_service	resource	migration-service	database-migration-service
azurerm_databox_edge_device	resource	migration-service	data-box-edge-device
azurerm_databricks_virtual_network_peering	resource	network-peering	databricks-virtual-network-peering
azurerm_databricks_workspace	resource	databricks-workspace	databricks-workspace
azurerm_datadog_monitor	resource	third-party-monitor	datadog-monitor
azurerm_dedicated_hardware_security_module	resource	managed-hsm	dedicated-hardware-security-module
azurerm_dedicated_host_group	resource	dedicated-host-group	dedicated-host-group
azurerm_dev_center_dev_box_definition	resource	developer-environment	dev-box-definition
azurerm_dev_center_project	resource	dev-center-project	dev-center-project
azurerm_dev_center	resource	dev-center	dev-center
azurerm_dev_test_lab	resource	developer-environment	dev-test-lab
azurerm_dev_test_linux_virtual_machine	resource	compute-instance	dev-test-linux-virtual-machine
azurerm_dev_test_windows_virtual_machine	resource	compute-instance	dev-test-windows-virtual-machine
azurerm_digital_twins_endpoint_eventgrid	resource	iot-detail	digital-twins-event-grid-endpoint
azurerm_digital_twins_instance	resource	digital-twins-instance	digital-twins-instance
azurerm_dns_a_record	resource	dns-record	dns-a-record
azurerm_dns_aaaa_record	resource	dns-record	dns-aaaa-record
azurerm_dns_cname_record	resource	dns-record	dns-cname-record
azurerm_dns_mx_record	resource	dns-record	dns-mx-record
azurerm_dns_ns_record	resource	dns-record	dns-ns-record
azurerm_dns_ptr_record	resource	dns-record	dns-ptr-record
azurerm_dns_srv_record	resource	dns-record	dns-srv-record
azurerm_dns_txt_record	resource	dns-record	dns-txt-record
azurerm_dns_zone	resource	dns-zone	dns-zone
azurerm_dynatrace_monitor	resource	third-party-monitor	dynatrace-monitor
azurerm_elastic_cloud_elasticsearch	resource	third-party-monitor	elastic-cloud
azurerm_elastic_san_volume_group	resource	elastic-san	elastic-san-volume-group
azurerm_elastic_san_volume	resource	block-storage-volume	elastic-san-volume
azurerm_elastic_san	resource	elastic-san	elastic-san
azurerm_email_communication_service	resource	email-communication-service	email-communication-service
azurerm_eventgrid_domain_topic	resource	event-grid-topic	event-grid-domain-topic
azurerm_eventgrid_domain	resource	event-grid-domain	event-grid-domain
azurerm_eventgrid_event_subscription	resource	message-subscription	event-grid-event-subscription
azurerm_eventgrid_namespace_topic	resource	message-topic	event-grid-namespace-topic
azurerm_eventgrid_namespace	resource	event-grid-domain	event-grid-namespace
azurerm_eventgrid_partner_namespace	resource	event-grid-domain	event-grid-partner-namespace
azurerm_eventgrid_system_topic_event_subscription	resource	message-subscription	event-grid-system-topic-subscription
azurerm_eventgrid_system_topic	resource	event-grid-topic	event-grid-system-topic
azurerm_eventgrid_topic	resource	event-grid-topic	event-grid-topic
azurerm_eventhub_cluster	resource	event-stream	event-hubs-cluster
azurerm_eventhub_consumer_group	resource	messaging-detail	event-hubs-consumer-group
azurerm_eventhub_namespace_schema_group	resource	messaging-detail	event-hubs-schema-group
azurerm_eventhub_namespace	resource	messaging-namespace	event-hubs-namespace
azurerm_eventhub	resource	event-stream	event-hub
azurerm_express_route_circuit	resource	dedicated-interconnect	expressroute-circuit
azurerm_express_route_gateway	resource	expressroute-gateway	expressroute-gateway
azurerm_express_route_port	resource	dedicated-interconnect	expressroute-port
azurerm_extended_location_custom_location	resource	custom-location	arc-custom-location
azurerm_fabric_capacity	resource	analytics-cluster	fabric-capacity
azurerm_firewall_policy_rule_collection_group	resource	firewall-policy	azure-firewall-policy-rule-collection-group
azurerm_firewall_policy	resource	firewall-policy	azure-firewall-policy
azurerm_firewall	resource	azure-firewall	azure-firewall
azurerm_fluid_relay_server	resource	realtime-communication-service	fluid-relay
azurerm_frontdoor	resource	front-door-profile	classic-front-door
azurerm_function_app_flex_consumption	resource	serverless-function	flex-consumption-function-app
azurerm_function_app_function	resource	serverless-function	function-app-function
azurerm_graph_services_account	resource	graph-data-connect-account	graph-data-connect-account
azurerm_hdinsight_hadoop_cluster	resource	analytics-cluster	hdinsight-hadoop-cluster
azurerm_hdinsight_hbase_cluster	resource	analytics-cluster	hdinsight-hbase-cluster
azurerm_hdinsight_interactive_query_cluster	resource	analytics-cluster	hdinsight-interactive-query-cluster
azurerm_hdinsight_kafka_cluster	resource	analytics-cluster	hdinsight-kafka-cluster
azurerm_hdinsight_spark_cluster	resource	analytics-cluster	hdinsight-spark-cluster
azurerm_healthbot	resource	bot-service	health-bot
azurerm_healthcare_dicom_service	resource	health-data-service	health-data-dicom-service
azurerm_healthcare_fhir_service	resource	health-data-service	health-data-fhir-service
azurerm_healthcare_medtech_service	resource	health-data-service	health-data-medtech-service
azurerm_healthcare_service	resource	health-data-service	healthcare-service
azurerm_healthcare_workspace	resource	health-data-workspace	health-data-services-workspace
azurerm_image	resource	compute-image	compute-image
azurerm_iotcentral_application	resource	iot-central-application	iot-central-application
azurerm_iothub_device_update_account	resource	iot-update-service	iot-hub-device-update-account
azurerm_iothub_device_update_instance	resource	iot-detail	iot-hub-device-update-instance
azurerm_iothub_dps	resource	iot-provisioning-service	iot-hub-device-provisioning-service
azurerm_iothub_endpoint_eventhub	resource	iot-detail	iot-hub-event-hubs-endpoint
azurerm_iothub_endpoint_servicebus_queue	resource	iot-detail	iot-hub-service-bus-queue-endpoint
azurerm_iothub_endpoint_storage_container	resource	iot-detail	iot-hub-storage-endpoint
azurerm_iothub	resource	iot-hub	iot-hub
azurerm_ip_group	resource	network-policy-detail	ip-group
azurerm_key_vault_access_policy	resource	security-detail	key-vault-access-policy
azurerm_key_vault_certificate	resource	security-detail	key-vault-certificate
azurerm_key_vault_key	resource	encryption-key	key-vault-key
azurerm_key_vault_managed_hardware_security_module_key	resource	encryption-key	managed-hsm-key
azurerm_key_vault_managed_hardware_security_module	resource	managed-hsm	managed-hsm
azurerm_key_vault_secret	resource	managed-secret	key-vault-secret
azurerm_key_vault	resource	key-vault	key-vault
azurerm_kubernetes_automatic_cluster	resource	kubernetes-cluster	automatic-kubernetes-cluster
azurerm_kubernetes_cluster_node_pool	resource	kubernetes-node-pool	aks-node-pool
azurerm_kubernetes_cluster	resource	kubernetes-cluster	aks-cluster
azurerm_kubernetes_fleet_manager	resource	kubernetes-fleet	kubernetes-fleet
azurerm_kusto_cluster	resource	data-explorer-cluster	data-explorer-cluster
azurerm_kusto_eventgrid_data_connection	resource	database-component	data-explorer-event-grid-connection
azurerm_kusto_eventhub_data_connection	resource	database-component	data-explorer-event-hubs-connection
azurerm_lb_backend_address_pool	resource	load-balancer-component	load-balancer-backend-pool
azurerm_lb_nat_rule	resource	load-balancer-component	load-balancer-nat-rule
azurerm_lb_outbound_rule	resource	load-balancer-component	load-balancer-outbound-rule
azurerm_lb_probe	resource	load-balancer-component	load-balancer-probe
azurerm_lb_rule	resource	load-balancer-component	load-balancer-rule
azurerm_lb	resource	load-balancer	load-balancer
azurerm_lighthouse_definition	resource	governance-detail	lighthouse-definition
azurerm_linux_function_app	resource	serverless-function	linux-function-app
azurerm_linux_virtual_machine_scale_set	resource	virtual-machine-scale-set	linux-virtual-machine-scale-set
azurerm_linux_virtual_machine	resource	compute-instance	linux-virtual-machine
azurerm_linux_web_app	resource	app-service	linux-web-app
azurerm_load_test	resource	load-test	load-test
azurerm_local_network_gateway	resource	local-network-gateway	local-network-gateway
azurerm_log_analytics_cluster	resource	log-analytics-workspace	log-analytics-cluster
azurerm_log_analytics_data_export_rule	resource	operations-detail	log-analytics-data-export-rule
azurerm_log_analytics_saved_search	resource	operations-detail	log-analytics-saved-search
azurerm_log_analytics_solution	resource	operations-detail	log-analytics-solution
azurerm_log_analytics_workspace_table	resource	operations-detail	log-analytics-workspace-table
azurerm_log_analytics_workspace	resource	log-analytics-workspace	log-analytics-workspace
azurerm_logic_app_action_http	resource	api-management-detail	logic-app-http-action
azurerm_logic_app_integration_account	resource	integration-account	logic-app-integration-account
azurerm_logic_app_standard	resource	workflow	logic-app-standard
azurerm_logic_app_trigger_recurrence	resource	api-management-detail	logic-app-recurrence-trigger
azurerm_logic_app_workflow	resource	workflow	logic-app-workflow
azurerm_machine_learning_compute_cluster	resource	machine-learning-compute	machine-learning-compute-cluster
azurerm_machine_learning_compute_instance	resource	machine-learning-compute	machine-learning-compute-instance
azurerm_machine_learning_inference_cluster	resource	ai-inference-endpoint	machine-learning-inference-cluster
azurerm_machine_learning_workspace	resource	machine-learning-workspace	machine-learning-workspace
azurerm_maintenance_configuration	resource	maintenance-configuration	maintenance-configuration
azurerm_managed_application	resource	managed-application	managed-application
azurerm_managed_devops_pool	resource	developer-environment	managed-devops-pool
azurerm_managed_disk	resource	block-storage-volume	managed-disk
azurerm_managed_lustre_file_system	resource	managed-file-storage	managed-lustre-file-system
azurerm_managed_redis_geo_replication	resource	database-component	managed-redis-geo-replication
azurerm_managed_redis	resource	managed-cache	azure-managed-redis
azurerm_maps_account	resource	maps-account	maps-account
azurerm_mongo_cluster	resource	managed-database	mongo-cluster
azurerm_monitor_action_group	resource	operations-detail	monitor-action-group
azurerm_monitor_data_collection_endpoint	resource	operations-detail	monitor-data-collection-endpoint
azurerm_monitor_diagnostic_setting	resource	operations-detail	monitor-diagnostic-setting
azurerm_monitor_metric_alert	resource	operations-detail	monitor-metric-alert
azurerm_monitor_private_link_scope	resource	private-link-scope	monitor-private-link-scope
azurerm_monitor_scheduled_query_rules_alert_v2	resource	operations-detail	monitor-scheduled-query-alert
azurerm_monitor_workspace	resource	monitor-workspace	monitor-workspace
azurerm_mssql_database	resource	logical-database	mssql-database
azurerm_mssql_elasticpool	resource	database-component	sql-elastic-pool
azurerm_mssql_failover_group	resource	database-component	sql-failover-group
azurerm_mssql_managed_database	resource	logical-database	sql-managed-database
azurerm_mssql_managed_instance	resource	managed-database	sql-managed-instance
azurerm_mssql_server	resource	sql-server	mssql-server
azurerm_mysql_flexible_database	resource	logical-database	mysql-database
azurerm_mysql_flexible_server	resource	managed-database	mysql-flexible-server
azurerm_nat_gateway_public_ip_association	resource	network-policy-detail	nat-gateway-public-ip-association
azurerm_nat_gateway_public_ip_prefix_association	resource	network-policy-detail	nat-gateway-public-ip-prefix-association
azurerm_nat_gateway	resource	managed-nat	nat-gateway
azurerm_netapp_account	resource	netapp-account	netapp-account
azurerm_netapp_backup_policy	resource	backup-plan	netapp-backup-policy
azurerm_netapp_backup_vault	resource	backup-vault	netapp-backup-vault
azurerm_netapp_pool	resource	netapp-capacity-pool	netapp-capacity-pool
azurerm_netapp_volume	resource	managed-file-storage	netapp-volume
azurerm_network_ddos_protection_plan	resource	ddos-protection-plan	ddos-protection-plan
azurerm_network_function_azure_traffic_collector	resource	network-function-service	network-function-traffic-collector
azurerm_network_manager_ipam_pool	resource	network-policy-detail	network-manager-ipam-pool
azurerm_network_manager	resource	virtual-network-manager	virtual-network-manager
azurerm_network_security_group	resource	network-security-group	network-security-group
azurerm_network_security_perimeter	resource	network-security-perimeter	network-security-perimeter
azurerm_network_security_rule	resource	network-policy-detail	network-security-rule
azurerm_network_watcher_flow_log	resource	operations-detail	network-watcher-flow-log
azurerm_network_watcher	resource	network-watcher	network-watcher
azurerm_new_relic_monitor	resource	third-party-monitor	new-relic-monitor
azurerm_nginx_deployment	resource	hybrid-platform	nginx-deployment
azurerm_notification_hub_namespace	resource	notification-namespace	notification-hubs-namespace
azurerm_notification_hub	resource	notification-hub	notification-hub
azurerm_oracle_autonomous_database	resource	managed-database	oracle-autonomous-database
azurerm_oracle_cloud_vm_cluster	resource	hybrid-platform	oracle-cloud-vm-cluster
azurerm_oracle_exadata_infrastructure	resource	hybrid-platform	oracle-exadata-infrastructure
azurerm_oracle_resource_anchor	resource	hybrid-platform	oracle-resource-anchor
azurerm_orchestrated_virtual_machine_scale_set	resource	virtual-machine-scale-set	orchestrated-virtual-machine-scale-set
azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack	resource	hybrid-platform	palo-alto-firewall
azurerm_playwright_workspace	resource	developer-environment	playwright-workspace
azurerm_point_to_site_vpn_gateway	resource	vpn-gateway	point-to-site-vpn-gateway
azurerm_policy_definition	resource	governance-detail	policy-definition
azurerm_policy_set_definition	resource	governance-detail	policy-set-definition
azurerm_portal_dashboard	resource	operations-detail	portal-dashboard
azurerm_postgresql_flexible_server_backup	resource	database-component	postgresql-backup
azurerm_postgresql_flexible_server_database	resource	logical-database	postgresql-database
azurerm_postgresql_flexible_server	resource	managed-database	postgresql-flexible-server
azurerm_powerbi_embedded	resource	analytics-cluster	power-bi-embedded-capacity
azurerm_private_dns_a_record	resource	dns-record	private-dns-a-record
azurerm_private_dns_cname_record	resource	dns-record	private-dns-cname-record
azurerm_private_dns_resolver_dns_forwarding_ruleset	resource	private-network-link	private-dns-forwarding-ruleset
azurerm_private_dns_resolver_inbound_endpoint	resource	private-network-link	private-dns-inbound-endpoint
azurerm_private_dns_resolver_outbound_endpoint	resource	private-network-link	private-dns-outbound-endpoint
azurerm_private_dns_resolver	resource	private-dns-resolver	private-dns-resolver
azurerm_private_dns_zone_virtual_network_link	resource	private-network-link	private-dns-zone-vnet-link
azurerm_private_dns_zone	resource	dns-zone	private-dns-zone
azurerm_private_endpoint	resource	private-endpoint	private-endpoint
azurerm_private_link_service	resource	private-link-service	private-link-service
azurerm_proximity_placement_group	resource	compute-placement	proximity-placement-group
azurerm_public_ip_prefix	resource	public-address	public-ip-prefix
azurerm_public_ip	resource	public-address	public-address
azurerm_purview_account	resource	purview-account	purview-account
azurerm_qumulo_file_system	resource	managed-file-storage	qumulo-file-system
azurerm_recovery_services_vault	resource	backup-vault	recovery-services-vault
azurerm_redhat_openshift_cluster	resource	kubernetes-cluster	red-hat-openshift-cluster
azurerm_redis_cache	resource	managed-cache	azure-cache-for-redis
azurerm_relay_hybrid_connection	resource	relay-connection	relay-hybrid-connection
azurerm_relay_namespace	resource	relay-namespace	relay-namespace
azurerm_resource_group	resource	resource-group	resource-group
azurerm_resource_policy_assignment	resource	governance-detail	resource-policy-assignment
azurerm_role_assignment	resource	governance-detail	role-assignment
azurerm_role_definition	resource	governance-detail	role-definition
azurerm_route_server	resource	route-table	route-server
azurerm_route_table	resource	route-table	route-table
azurerm_route	resource	network-policy-detail	route
azurerm_search_service	resource	ai-search-service	ai-search-service
azurerm_security_center_subscription_pricing	resource	defender-plan	defender-subscription-plan
azurerm_security_center_workspace	resource	defender-plan	defender-workspace
azurerm_sentinel_alert_rule_nrt	resource	security-detail	sentinel-nrt-alert-rule
azurerm_sentinel_alert_rule_scheduled	resource	security-detail	sentinel-scheduled-alert-rule
azurerm_sentinel_automation_rule	resource	security-detail	sentinel-automation-rule
azurerm_sentinel_data_connector_aws_cloud_trail	resource	security-detail	sentinel-aws-cloudtrail-connector
azurerm_sentinel_data_connector_azure_active_directory	resource	security-detail	sentinel-entra-connector
azurerm_service_fabric_cluster	resource	service-fabric-cluster	service-fabric-cluster
azurerm_service_fabric_managed_cluster	resource	service-fabric-cluster	managed-service-fabric-cluster
azurerm_service_plan	resource	app-service-plan	app-service-plan
azurerm_servicebus_namespace	resource	messaging-namespace	service-bus-namespace
azurerm_servicebus_queue	resource	message-queue	service-bus-queue
azurerm_servicebus_subscription_rule	resource	messaging-detail	service-bus-subscription-rule
azurerm_servicebus_subscription	resource	message-subscription	service-bus-subscription
azurerm_servicebus_topic	resource	service-bus-topic	service-bus-topic
azurerm_shared_image_gallery	resource	image-gallery	compute-gallery
azurerm_shared_image	resource	compute-image	shared-image
azurerm_signalr_service	resource	realtime-communication-service	signalr-service
azurerm_site_recovery_fabric	resource	site-recovery-fabric	site-recovery-fabric
azurerm_site_recovery_protection_container	resource	site-recovery-fabric	site-recovery-protection-container
azurerm_site_recovery_replicated_vm	resource	site-recovery-detail	site-recovery-replicated-vm
azurerm_site_recovery_replication_recovery_plan	resource	site-recovery-detail	site-recovery-plan
azurerm_snapshot	resource	disk-snapshot	disk-snapshot
azurerm_spring_cloud_app	resource	spring-app	spring-app
azurerm_spring_cloud_gateway	resource	spring-app	spring-apps-gateway
azurerm_spring_cloud_service	resource	spring-apps-service	spring-apps-service
azurerm_stack_hci_cluster	resource	azure-local-cluster	azure-local-cluster
azurerm_stack_hci_virtual_hard_disk	resource	block-storage-volume	stack-hci-virtual-hard-disk
azurerm_static_web_app	resource	static-web-app	static-web-app
azurerm_storage_account	resource	storage-account	storage-account
azurerm_storage_blob	resource	storage-object-detail	storage-blob
azurerm_storage_container	resource	object-storage-container	blob-container
azurerm_storage_data_lake_gen2_filesystem	resource	object-storage-container	data-lake-filesystem
azurerm_storage_data_lake_gen2_path	resource	storage-object-detail	data-lake-path
azurerm_storage_encryption_scope	resource	storage-object-detail	storage-encryption-scope
azurerm_storage_management_policy	resource	storage-object-detail	storage-management-policy
azurerm_storage_mover	resource	migration-service	storage-mover
azurerm_storage_queue	resource	message-queue	queue-storage-queue
azurerm_storage_share_directory	resource	storage-object-detail	storage-share-directory
azurerm_storage_share_file	resource	storage-object-detail	storage-share-file
azurerm_storage_share	resource	managed-file-storage	azure-files-share
azurerm_storage_sync	resource	storage-sync-service	storage-sync-service
azurerm_storage_table_entity	resource	storage-object-detail	storage-table-entity
azurerm_storage_table	resource	table-storage-table	table-storage-table
azurerm_stream_analytics_cluster	resource	analytics-cluster	stream-analytics-cluster
azurerm_stream_analytics_job	resource	stream-analytics-job	stream-analytics-job
azurerm_stream_analytics_output_blob	resource	data-integration-detail	stream-analytics-blob-output
azurerm_stream_analytics_stream_input_eventhub_v2	resource	data-integration-detail	stream-analytics-event-hubs-input
azurerm_subnet_nat_gateway_association	resource	network-policy-detail	subnet-nat-gateway-association
azurerm_subnet_network_security_group_association	resource	network-policy-detail	subnet-network-security-group-association
azurerm_subnet_route_table_association	resource	network-policy-detail	subnet-route-table-association
azurerm_subnet	resource	subnet	subnet
azurerm_synapse_private_link_hub	resource	private-link-scope	synapse-private-link-hub
azurerm_synapse_spark_pool	resource	analytics-pool	synapse-spark-pool
azurerm_synapse_sql_pool	resource	analytics-pool	synapse-sql-pool
azurerm_synapse_workspace	resource	synapse-workspace	synapse-workspace
azurerm_system_center_virtual_machine_manager_server	resource	hybrid-platform	system-center-vmm-server
azurerm_system_center_virtual_machine_manager_virtual_machine_instance	resource	compute-instance	system-center-virtual-machine
azurerm_traffic_manager_azure_endpoint	resource	load-balancer-component	traffic-manager-azure-endpoint
azurerm_traffic_manager_profile	resource	traffic-manager-profile	traffic-manager-profile
azurerm_trusted_signing_account	resource	trusted-signing-account	trusted-signing-account
azurerm_user_assigned_identity	resource	service-identity	user-assigned-managed-identity
azurerm_video_indexer_account	resource	video-indexer-account	video-indexer-account
azurerm_virtual_desktop_application_group	resource	virtual-desktop-application-group	virtual-desktop-application-group
azurerm_virtual_desktop_application	resource	compute-placement	virtual-desktop-application
azurerm_virtual_desktop_host_pool	resource	virtual-desktop-host-pool	virtual-desktop-host-pool
azurerm_virtual_desktop_scaling_plan	resource	compute-placement	virtual-desktop-scaling-plan
azurerm_virtual_desktop_workspace	resource	virtual-desktop-workspace	virtual-desktop-workspace
azurerm_virtual_hub	resource	virtual-hub	virtual-hub
azurerm_virtual_machine_restore_point	resource	disk-snapshot	virtual-machine-restore-point
azurerm_virtual_machine_scale_set	resource	virtual-machine-scale-set	virtual-machine-scale-set
azurerm_virtual_machine	resource	compute-instance	virtual-machine
azurerm_virtual_network_gateway_connection	resource	vpn-connection	virtual-network-gateway-connection
azurerm_virtual_network_gateway	resource	vpn-gateway	virtual-network-gateway
azurerm_virtual_network_peering	resource	network-peering	virtual-network-peering
azurerm_virtual_network	resource	virtual-network	virtual-network
azurerm_virtual_wan	resource	virtual-wan	virtual-wan
azurerm_vmware_cluster	resource	hybrid-platform	vmware-cluster
azurerm_vmware_private_cloud	resource	vmware-private-cloud	vmware-private-cloud
azurerm_vpn_gateway_connection	resource	vpn-connection	vpn-gateway-connection
azurerm_vpn_gateway	resource	vpn-gateway	vpn-gateway
azurerm_vpn_site	resource	local-network-gateway	vpn-site
azurerm_web_application_firewall_policy	resource	web-application-firewall-policy	web-application-firewall-policy
azurerm_web_pubsub	resource	realtime-communication-service	web-pubsub
azurerm_windows_function_app	resource	serverless-function	windows-function-app
azurerm_windows_virtual_machine_scale_set	resource	virtual-machine-scale-set	windows-virtual-machine-scale-set
azurerm_windows_virtual_machine	resource	compute-instance	windows-virtual-machine
azurerm_windows_web_app	resource	app-service	windows-web-app
azurerm_workloads_sap_discovery_virtual_instance	resource	hybrid-platform	sap-discovery-virtual-instance
azurerm_workloads_sap_single_node_virtual_instance	resource	hybrid-platform	sap-single-node-virtual-instance
azurerm_workloads_sap_three_tier_virtual_instance	resource	hybrid-platform	sap-three-tier-virtual-instance

Local vocabulary

Concepts

azure.concept.ai-foundry Source

A Microsoft Foundry account or project boundary.

Used by ai-foundry, ai-foundry-project, ai-services-project.

azure.concept.ai-inference-endpoint Source

A managed endpoint that serves model inference requests.

Used by ai-model-deployment, machine-learning-inference-cluster.

azure.concept.ai-search-service Source

An Azure AI Search service.

Used by ai-search-service.

azure.concept.ai-service-account Source

An Azure AI services account exposing managed AI APIs.

Used by ai-services-account.

azure.concept.analytics-cluster Source

A managed Azure analytics cluster or server.

Used by 9 Rules

• analysis-services-server
• fabric-capacity
• hdinsight-hadoop-cluster
• hdinsight-hbase-cluster
• hdinsight-interactive-query-cluster
• hdinsight-kafka-cluster
• hdinsight-spark-cluster
• power-bi-embedded-capacity
• stream-analytics-cluster

azure.concept.analytics-pool Source

A SQL or Apache Spark analytics pool.

Used by synapse-spark-pool, synapse-sql-pool.

azure.concept.api-gateway Source

A managed gateway that exposes and governs APIs.

Used by api-management, api-management-standalone-gateway.

azure.concept.api-management-detail Source

An API, product, backend, policy, workspace, or gateway configuration inside API Management.

Used by 8 Rules

• api-management-api
• api-management-backend
• api-management-gateway
• api-management-policy
• api-management-product
• api-management-workspace
• logic-app-http-action
• logic-app-recurrence-trigger

azure.concept.app-configuration Source

An Azure App Configuration store.

Used by app-configuration.

azure.concept.app-service Source

An Azure App Service web application runtime.

Used by linux-web-app, windows-web-app.

azure.concept.app-service-environment Source

An isolated Azure App Service hosting environment.

Used by app-service-environment.

azure.concept.app-service-plan Source

An Azure App Service plan providing shared runtime capacity.

Used by 6 Rules

• app-service-plan
• flex-consumption-function-app
• linux-function-app
• linux-web-app
• windows-function-app
• windows-web-app

azure.concept.application-insights Source

An Azure Monitor Application Insights application resource.

Used by application-insights, linux-function-app, windows-function-app.

azure.concept.arc-enabled-server Source

A server connected to Azure through Azure Arc.

Used by arc-enabled-server.

azure.concept.arc-resource-bridge Source

An Azure Arc resource bridge connecting an external platform.

Used by arc-resource-bridge.

azure.concept.attestation-provider Source

A Microsoft Azure Attestation provider.

Used by attestation-provider.

azure.concept.automation-account Source

An Azure Automation account owning runbooks and schedules.

Used by automation-account.

azure.concept.azure-enclave Source

An Azure Enclave isolated workload and connectivity boundary.

Used by azure-enclave.

azure.concept.azure-firewall Source

An Azure Firewall managed network security service.

Used by azure-firewall.

azure.concept.azure-local-cluster Source

An Azure Local or Azure Stack HCI cluster.

Used by azure-local-cluster.

azure.concept.backup-plan Source

A managed policy scheduling and retaining backups.

Used by 5 Rules

• data-protection-blob-backup-policy
• data-protection-disk-backup-policy
• file-share-backup-policy
• netapp-backup-policy
• virtual-machine-backup-policy

azure.concept.backup-vault Source

A managed vault storing protected recovery data.

Used by data-protection-backup-vault, netapp-backup-vault, recovery-services-vault.

azure.concept.bastion-host Source

An Azure Bastion service providing managed private administration access.

Used by bastion-host.

azure.concept.batch-account Source

An Azure Batch account owning pools, jobs, and applications.

Used by batch-account.

azure.concept.batch-pool Source

A pool providing compute capacity to Azure Batch.

Used by batch-application, batch-pool.

azure.concept.block-storage-volume Source

A durable block-storage volume attachable to compute workloads.

Used by elastic-san-volume, managed-disk, stack-hci-virtual-hard-disk.

azure.concept.bot-service Source

An Azure Bot Service bot registration or application.

Used by 4 Rules

• azure-bot
• bot-channels-registration
• bot-web-app
• health-bot

azure.concept.chaos-experiment Source

An Azure Chaos Studio experiment.

Used by chaos-studio-experiment.

azure.concept.communication-service Source

An Azure Communication Services resource.

Used by communication-service.

azure.concept.compute-image Source

A reusable Azure compute image or image definition.

Used by compute-image, shared-image.

azure.concept.compute-instance Source

A provisioned compute instance running a workload.

Used by 6 Rules

• dev-test-linux-virtual-machine
• dev-test-windows-virtual-machine
• linux-virtual-machine
• system-center-virtual-machine
• virtual-machine
• windows-virtual-machine

azure.concept.compute-placement Source

Availability, proximity, reservation, or host placement supporting Azure compute.

Used by 6 Rules

• availability-set
• capacity-reservation
• capacity-reservation-group
• proximity-placement-group
• virtual-desktop-application
• virtual-desktop-scaling-plan

azure.concept.confidential-ledger Source

An Azure confidential ledger providing tamper-evident storage.

Used by confidential-ledger.

azure.concept.container-app Source

An Azure Container Apps service running container revisions.

Used by container-app.

azure.concept.container-app-environment Source

An Azure Container Apps environment sharing network and operational boundaries.

Used by container-app, container-app-environment, container-app-job.

azure.concept.container-app-job Source

An Azure Container Apps job running finite container work.

Used by container-app-job.

azure.concept.container-instance-group Source

An Azure Container Instances container group scheduled as one unit.

Used by container-instance-group.

azure.concept.container-registry Source

An Azure Container Registry storing and distributing OCI artifacts.

Used by connected-container-registry, container-registry.

azure.concept.content-delivery-profile Source

An Azure content delivery profile serving cached content globally.

Used by cdn-endpoint, cdn-profile.

azure.concept.cosmos-account Source

An Azure Cosmos DB account defining global distribution and API boundaries.

Used by 6 Rules

• cosmos-account
• cosmos-cassandra-keyspace
• cosmos-dedicated-gateway
• cosmos-gremlin-database
• cosmos-mongo-database
• cosmos-sql-database

azure.concept.custom-location Source

An Azure Arc custom location extending Azure resource placement.

Used by arc-custom-location.

azure.concept.data-explorer-cluster Source

An Azure Data Explorer cluster serving real-time analytics.

Used by data-explorer-cluster.

azure.concept.data-factory Source

An Azure Data Factory integration and orchestration boundary.

Used by data-factory.

azure.concept.data-integration-detail Source

A dataset, linked service, trigger, connection, or data-flow supporting integration.

Used by 9 Rules

• data-factory-blob-dataset
• data-factory-blob-linked-service
• data-factory-data-flow
• data-factory-managed-private-endpoint
• data-factory-schedule-trigger
• data-factory-sql-dataset
• data-factory-sql-linked-service
• stream-analytics-blob-output
• stream-analytics-event-hubs-input

azure.concept.data-integration-runtime Source

A managed or self-hosted Azure data integration runtime.

Used by data-factory-azure-integration-runtime, data-factory-self-hosted-integration-runtime.

azure.concept.data-share-account Source

An Azure Data Share account.

Used by data-share-account.

azure.concept.database-component Source

A table, container, graph, configuration, replica, or policy supporting an Azure database.

Used by 11 Rules

• cosmos-cassandra-table
• cosmos-dedicated-gateway
• cosmos-gremlin-graph
• cosmos-mongo-collection
• cosmos-sql-container
• data-explorer-event-grid-connection
• data-explorer-event-hubs-connection
• managed-redis-geo-replication
• postgresql-backup
• sql-elastic-pool
• sql-failover-group

azure.concept.databricks-workspace Source

An Azure Databricks workspace.

Used by databricks-workspace.

azure.concept.ddos-protection-plan Source

An Azure DDoS Protection plan protecting virtual networks.

Used by ddos-protection-plan.

azure.concept.dedicated-host-group Source

An Azure Dedicated Host placement group.

Used by dedicated-host-group.

azure.concept.dedicated-interconnect Source

A dedicated private connection between an external network and a cloud provider.

Used by expressroute-circuit, expressroute-port.

azure.concept.defender-plan Source

A Microsoft Defender for Cloud protection plan or workspace integration.

Used by defender-subscription-plan, defender-workspace.

azure.concept.dev-center Source

A Microsoft Dev Box and deployment-environment Dev Center.

Used by dev-center.

azure.concept.dev-center-project Source

A Dev Center project boundary.

Used by dev-center-project.

azure.concept.developer-environment Source

A developer workstation, environment, or testing workspace.

Used by 4 Rules

• dev-box-definition
• dev-test-lab
• managed-devops-pool
• playwright-workspace

azure.concept.digital-twins-instance Source

An Azure Digital Twins service instance.

Used by digital-twins-instance.

azure.concept.disk-snapshot Source

A point-in-time snapshot of Azure disk storage.

Used by disk-snapshot, virtual-machine-restore-point.

azure.concept.dns-record Source

A DNS record inside an Azure DNS zone.

Used by 10 Rules

• dns-a-record
• dns-aaaa-record
• dns-cname-record
• dns-mx-record
• dns-ns-record
• dns-ptr-record
• dns-srv-record
• dns-txt-record
• private-dns-a-record
• private-dns-cname-record

azure.concept.dns-zone Source

A managed DNS namespace containing resource records.

Used by 14 Rules

• dns-a-record
• dns-aaaa-record
• dns-cname-record
• dns-mx-record
• dns-ns-record
• dns-ptr-record
• dns-srv-record
• dns-txt-record
• dns-zone
• postgresql-flexible-server
• private-dns-a-record
• private-dns-cname-record
• private-dns-zone
• private-dns-zone-vnet-link

azure.concept.elastic-san Source

An Azure Elastic SAN storage boundary.

Used by elastic-san, elastic-san-volume-group.

azure.concept.email-communication-service Source

An Azure Communication Services Email resource.

Used by email-communication-service.

azure.concept.encryption-key Source

A managed key used for cryptographic operations.

Used by key-vault-key, managed-hsm-key.

azure.concept.entra-application Source

A Microsoft Entra application identity definition.

Used by entra-application, entra-application-registration.

azure.concept.entra-directory Source

A Microsoft Entra External ID directory boundary.

Used by entra-external-id-directory.

azure.concept.entra-domain-service Source

A Microsoft Entra Domain Services managed domain.

Used by entra-domain-services.

azure.concept.event-grid-domain Source

An Azure Event Grid domain or namespace owning event topics.

Used by 5 Rules

• event-grid-domain
• event-grid-domain-topic
• event-grid-namespace
• event-grid-namespace-topic
• event-grid-partner-namespace

azure.concept.event-grid-topic Source

An Azure Event Grid custom, domain, or system topic owning event subscriptions.

Used by 4 Rules

• event-grid-domain-topic
• event-grid-event-subscription
• event-grid-system-topic
• event-grid-topic

azure.concept.event-stream Source

An Azure Event Hubs append-only event stream.

Used by 5 Rules

• event-grid-event-subscription
• event-grid-system-topic-subscription
• event-hub
• event-hubs-cluster
• event-hubs-consumer-group

azure.concept.expressroute-gateway Source

An Azure ExpressRoute gateway connecting a virtual network to private circuits.

Used by expressroute-gateway.

azure.concept.firewall-policy Source

An Azure Firewall or web application firewall policy.

Used by azure-firewall-policy, azure-firewall-policy-rule-collection-group.

azure.concept.front-door-profile Source

An Azure Front Door global application delivery profile.

Used by classic-front-door, front-door-profile.

azure.concept.governance-detail Source

An Azure policy, role, deployment, budget, or governance configuration.

Used by 6 Rules

• lighthouse-definition
• policy-definition
• policy-set-definition
• resource-policy-assignment
• role-assignment
• role-definition

azure.concept.graph-data-connect-account Source

A Microsoft Graph Data Connect service account.

Used by graph-data-connect-account.

azure.concept.health-data-service Source

A FHIR, DICOM, or MedTech service in Azure Health Data Services.

Used by 4 Rules

• health-data-dicom-service
• health-data-fhir-service
• health-data-medtech-service
• healthcare-service

azure.concept.health-data-workspace Source

An Azure Health Data Services workspace owning healthcare data services.

Used by health-data-services-workspace.

azure.concept.hybrid-platform Source

A hybrid or partner platform managed through Azure.

Used by 10 Rules

• nginx-deployment
• oracle-cloud-vm-cluster
• oracle-exadata-infrastructure
• oracle-resource-anchor
• palo-alto-firewall
• sap-discovery-virtual-instance
• sap-single-node-virtual-instance
• sap-three-tier-virtual-instance
• system-center-vmm-server
• vmware-cluster

azure.concept.identity-governance-detail Source

A location, assignment, federation, role, or policy supporting identity governance.

Used by 7 Rules

• entra-access-package-assignment-policy
• entra-app-role-assignment
• entra-application-federated-identity
• entra-authentication-strength-policy
• entra-domain-services-replica-set
• entra-domain-services-trust
• entra-named-location

azure.concept.identity-group Source

A managed group principal used to assign access collectively.

Used by entra-group, entra-group-without-members.

azure.concept.image-gallery Source

An Azure Compute Gallery owning image definitions and versions.

Used by compute-gallery.

azure.concept.integration-account Source

An Azure Logic Apps integration account.

Used by logic-app-integration-account.

azure.concept.integration-connection Source

An Azure API or App Service connection supporting integration.

Used by api-connection, app-service-connection.

azure.concept.iot-central-application Source

An Azure IoT Central application.

Used by iot-central-application.

azure.concept.iot-detail Source

A route, endpoint, consumer group, certificate, or organization supporting Azure IoT.

Used by 5 Rules

• digital-twins-event-grid-endpoint
• iot-hub-device-update-instance
• iot-hub-event-hubs-endpoint
• iot-hub-service-bus-queue-endpoint
• iot-hub-storage-endpoint

azure.concept.iot-hub Source

An Azure IoT Hub device messaging service.

Used by iot-hub.

azure.concept.iot-provisioning-service Source

An Azure IoT Hub Device Provisioning Service.

Used by iot-hub-device-provisioning-service.

azure.concept.iot-update-service Source

An Azure Device Update for IoT Hub account boundary.

Used by iot-hub-device-update-account.

azure.concept.key-vault Source

An Azure Key Vault security boundary for keys, secrets, and certificates.

Used by 5 Rules

• key-vault
• key-vault-access-policy
• key-vault-certificate
• key-vault-key
• key-vault-secret

azure.concept.kubernetes-fleet Source

An Azure Kubernetes Fleet Manager fleet coordinating Kubernetes clusters.

Used by kubernetes-fleet.

azure.concept.kubernetes-node-pool Source

A node pool contributing compute capacity to a Kubernetes cluster.

Used by aks-node-pool.

azure.concept.load-balancer Source

A load-balancing service composed from routing infrastructure.

Used by 5 Rules

• application-gateway
• application-load-balancer
• load-balancer
• load-balancer-backend-pool
• load-balancer-rule

azure.concept.load-balancer-component Source

A frontend, backend, route, probe, rule, or policy supporting Azure load balancing.

Used by 11 Rules

• application-load-balancer-frontend
• front-door-endpoint
• front-door-origin
• front-door-origin-group
• front-door-route
• load-balancer-backend-pool
• load-balancer-nat-rule
• load-balancer-outbound-rule
• load-balancer-probe
• load-balancer-rule
• traffic-manager-azure-endpoint

azure.concept.load-test Source

An Azure Load Testing resource.

Used by load-test.

azure.concept.local-network-gateway Source

An Azure representation of an external VPN site gateway.

Used by local-network-gateway, vpn-site.

azure.concept.log-analytics-workspace Source

An Azure Log Analytics workspace collecting operational data.

Used by 9 Rules

• aks-cluster
• application-insights
• container-app-environment
• log-analytics-cluster
• log-analytics-data-export-rule
• log-analytics-saved-search
• log-analytics-solution
• log-analytics-workspace
• log-analytics-workspace-table

azure.concept.logical-database Source

A logical database or keyspace contained by an Azure managed database service.

Used by 12 Rules

• cosmos-cassandra-keyspace
• cosmos-cassandra-table
• cosmos-gremlin-database
• cosmos-gremlin-graph
• cosmos-mongo-collection
• cosmos-mongo-database
• cosmos-sql-container
• cosmos-sql-database
• mssql-database
• mysql-database
• postgresql-database
• sql-managed-database

azure.concept.machine-learning-compute Source

Compute capacity attached to Azure Machine Learning.

Used by machine-learning-compute-cluster, machine-learning-compute-instance.

azure.concept.machine-learning-workspace Source

An Azure Machine Learning workspace.

Used by machine-learning-workspace.

azure.concept.maintenance-configuration Source

An Azure maintenance configuration defining update windows.

Used by maintenance-configuration.

azure.concept.managed-application Source

An Azure Managed Application deployment.

Used by managed-application.

azure.concept.managed-cache Source

A managed in-memory cache service.

Used by azure-cache-for-redis, azure-managed-redis.

azure.concept.managed-file-storage Source

A managed shared file-storage service.

Used by 4 Rules

• azure-files-share
• managed-lustre-file-system
• netapp-volume
• qumulo-file-system

azure.concept.managed-grafana Source

An Azure Managed Grafana workspace.

Used by managed-grafana.

azure.concept.managed-hsm Source

An Azure Key Vault Managed HSM security boundary.

Used by dedicated-hardware-security-module, managed-hsm, managed-hsm-key.

azure.concept.managed-nat Source

A managed network address translation service.

Used by 4 Rules

• nat-gateway
• nat-gateway-public-ip-association
• nat-gateway-public-ip-prefix-association
• subnet-nat-gateway-association

azure.concept.managed-secret Source

A managed secret identity whose sensitive value stays outside architecture output.

Used by key-vault-secret.

azure.concept.maps-account Source

An Azure Maps account exposing geospatial platform APIs.

Used by maps-account.

azure.concept.message-queue Source

A managed queue buffering work or messages for asynchronous consumers.

Used by 4 Rules

• event-grid-event-subscription
• event-grid-system-topic-subscription
• queue-storage-queue
• service-bus-queue

azure.concept.message-subscription Source

A durable subscription consuming messages from a topic.

Used by event-grid-event-subscription, event-grid-system-topic-subscription, service-bus-subscription.

azure.concept.message-topic Source

A messaging topic receiving messages from publishers.

Used by event-grid-namespace-topic.

azure.concept.messaging-detail Source

A consumer group, authorization rule, schema, route, or endpoint supporting messaging.

Used by event-hubs-consumer-group, event-hubs-schema-group, service-bus-subscription-rule.

azure.concept.messaging-namespace Source

An Azure messaging namespace owning queues, topics, or event streams.

Used by 6 Rules

• event-hub
• event-hubs-namespace
• event-hubs-schema-group
• service-bus-namespace
• service-bus-queue
• service-bus-topic

azure.concept.migration-service Source

An Azure migration or movement service.

Used by 4 Rules

• data-box-edge-device
• database-migration-project
• database-migration-service
• storage-mover

azure.concept.monitor-workspace Source

An Azure Monitor workspace.

Used by monitor-workspace.

azure.concept.netapp-account Source

An Azure NetApp Files account.

Used by netapp-account.

azure.concept.netapp-capacity-pool Source

An Azure NetApp Files capacity pool.

Used by netapp-capacity-pool.

azure.concept.network-function-service Source

An Azure managed network-function collection or control service.

Used by network-function-traffic-collector.

azure.concept.network-peering Source

A direct private connectivity agreement between virtual networks.

Used by databricks-virtual-network-peering, virtual-network-peering.

azure.concept.network-policy-detail Source

A route, security rule, association, or network policy supporting Azure networking.

Used by 10 Rules

• application-security-group
• ip-group
• nat-gateway-public-ip-association
• nat-gateway-public-ip-prefix-association
• network-manager-ipam-pool
• network-security-rule
• route
• subnet-nat-gateway-association
• subnet-network-security-group-association
• subnet-route-table-association

azure.concept.network-security-group Source

An Azure Network Security Group containing stateful traffic rules.

Used by network-security-group.

azure.concept.network-security-perimeter Source

An Azure Network Security Perimeter isolating platform services.

Used by network-security-perimeter.

azure.concept.network-watcher Source

An Azure Network Watcher regional network monitoring service.

Used by network-watcher.

azure.concept.notification-hub Source

An Azure Notification Hubs push-notification hub.

Used by notification-hub.

azure.concept.notification-namespace Source

An Azure Notification Hubs namespace.

Used by notification-hubs-namespace.

azure.concept.operations-detail Source

An alert, diagnostic, workbook, schedule, dashboard, or operational configuration.

Used by 13 Rules

• application-insights-web-test
• automation-schedule
• log-analytics-data-export-rule
• log-analytics-saved-search
• log-analytics-solution
• log-analytics-workspace-table
• monitor-action-group
• monitor-data-collection-endpoint
• monitor-diagnostic-setting
• monitor-metric-alert
• monitor-scheduled-query-alert
• network-watcher-flow-log
• portal-dashboard

azure.concept.private-dns-resolver Source

An Azure DNS Private Resolver forwarding DNS between networks.

Used by private-dns-resolver.

azure.concept.private-endpoint Source

A private endpoint exposing a service inside a virtual network.

Used by private-endpoint.

azure.concept.private-link-scope Source

An Azure private-link scope or hub grouping private service connectivity.

Used by arc-private-link-scope, monitor-private-link-scope, synapse-private-link-hub.

azure.concept.private-link-service Source

An Azure Private Link service publishing a private endpoint target.

Used by private-link-service.

azure.concept.private-network-link Source

An Azure Private DNS virtual network link.

Used by 4 Rules

• private-dns-forwarding-ruleset
• private-dns-inbound-endpoint
• private-dns-outbound-endpoint
• private-dns-zone-vnet-link

azure.concept.public-address Source

A public Azure IP address exposed to network traffic.

Used by 5 Rules

• custom-ip-prefix
• nat-gateway-public-ip-association
• nat-gateway-public-ip-prefix-association
• public-address
• public-ip-prefix

azure.concept.purview-account Source

A Microsoft Purview data governance account.

Used by purview-account.

azure.concept.realtime-communication-service Source

An Azure managed real-time communication service.

Used by fluid-relay, signalr-service, web-pubsub.

azure.concept.relay-connection Source

An Azure Relay hybrid connection.

Used by relay-hybrid-connection.

azure.concept.relay-namespace Source

An Azure Relay namespace.

Used by relay-namespace.

azure.concept.resource-group Source

An Azure Resource Group lifecycle and access boundary.

Used by 224 Rules

• ai-foundry
• ai-search-service
• ai-services-account
• aks-cluster
• analysis-services-server
• api-management
• api-management-standalone-gateway
• app-configuration
• app-service-environment
• app-service-plan
• application-gateway
• application-insights
• application-load-balancer
• arc-custom-location
• arc-enabled-server
• arc-kubernetes-cluster
• arc-private-link-scope
• arc-provisioned-kubernetes-cluster
• arc-resource-bridge
• attestation-provider
• automatic-kubernetes-cluster
• automation-account
• automation-runbook
• azure-bot
• azure-cache-for-redis
• azure-firewall
• azure-local-cluster
• azure-managed-redis
• bastion-host
• batch-account
• bot-channels-registration
• bot-web-app
• cdn-endpoint
• cdn-profile
• chaos-studio-experiment
• classic-front-door
• communication-service
• compute-gallery
• compute-image
• confidential-ledger
• container-app
• container-app-environment
• container-app-job
• container-instance-group
• container-registry
• cosmos-account
• cosmos-cassandra-cluster
• cosmos-postgresql-cluster
• custom-ip-prefix
• data-box-edge-device
• data-explorer-cluster
• data-factory
• data-protection-backup-vault
• data-share-account
• database-migration-project
• database-migration-service
• databricks-virtual-network-peering
• databricks-workspace
• datadog-monitor
• ddos-protection-plan
• dedicated-hardware-security-module
• dedicated-host-group
• dev-center
• dev-center-project
• dev-test-lab
• dev-test-linux-virtual-machine
• dev-test-windows-virtual-machine
• digital-twins-instance
• disk-snapshot
• dns-zone
• dynatrace-monitor
• elastic-cloud
• elastic-san
• email-communication-service
• entra-domain-services
• entra-external-id-directory
• event-grid-domain
• event-grid-namespace
• event-grid-partner-namespace
• event-grid-system-topic
• event-grid-topic
• event-hubs-cluster
• event-hubs-namespace
• expressroute-circuit
• expressroute-gateway
• expressroute-port
• fabric-capacity
• file-share-backup-policy
• flex-consumption-function-app
• fluid-relay
• front-door-profile
• graph-data-connect-account
• hdinsight-hadoop-cluster
• hdinsight-hbase-cluster
• hdinsight-interactive-query-cluster
• hdinsight-kafka-cluster
• hdinsight-spark-cluster
• health-bot
• health-data-fhir-service
• health-data-services-workspace
• healthcare-service
• iot-central-application
• iot-hub
• iot-hub-device-provisioning-service
• iot-hub-device-update-account
• key-vault
• kubernetes-fleet
• linux-function-app
• linux-virtual-machine
• linux-virtual-machine-scale-set
• linux-web-app
• load-balancer
• load-test
• local-network-gateway
• log-analytics-cluster
• log-analytics-solution
• log-analytics-workspace
• logic-app-integration-account
• logic-app-standard
• logic-app-workflow
• machine-learning-workspace
• maintenance-configuration
• managed-application
• managed-devops-pool
• managed-disk
• managed-grafana
• managed-hsm
• managed-lustre-file-system
• managed-service-fabric-cluster
• maps-account
• mongo-cluster
• monitor-private-link-scope
• monitor-workspace
• mssql-server
• mysql-database
• mysql-flexible-server
• nat-gateway
• netapp-account
• netapp-backup-policy
• netapp-backup-vault
• netapp-capacity-pool
• netapp-volume
• network-function-traffic-collector
• network-security-group
• network-security-perimeter
• network-watcher
• new-relic-monitor
• nginx-deployment
• notification-hub
• notification-hubs-namespace
• oracle-autonomous-database
• oracle-cloud-vm-cluster
• oracle-exadata-infrastructure
• oracle-resource-anchor
• orchestrated-virtual-machine-scale-set
• palo-alto-firewall
• playwright-workspace
• point-to-site-vpn-gateway
• postgresql-flexible-server
• power-bi-embedded-capacity
• private-dns-resolver
• private-dns-zone
• private-endpoint
• private-link-service
• public-address
• public-ip-prefix
• purview-account
• qumulo-file-system
• recovery-services-vault
• red-hat-openshift-cluster
• relay-hybrid-connection
• relay-namespace
• resource-group
• route-server
• route-table
• sap-discovery-virtual-instance
• sap-single-node-virtual-instance
• sap-three-tier-virtual-instance
• service-bus-namespace
• service-fabric-cluster
• shared-image
• signalr-service
• site-recovery-fabric
• site-recovery-protection-container
• spring-app
• spring-apps-service
• sql-managed-instance
• stack-hci-virtual-hard-disk
• static-web-app
• storage-account
• storage-mover
• storage-sync-service
• stream-analytics-cluster
• stream-analytics-job
• subnet
• synapse-private-link-hub
• synapse-workspace
• system-center-vmm-server
• traffic-manager-profile
• trusted-signing-account
• user-assigned-managed-identity
• video-indexer-account
• virtual-desktop-application-group
• virtual-desktop-host-pool
• virtual-desktop-workspace
• virtual-hub
• virtual-machine
• virtual-machine-backup-policy
• virtual-machine-scale-set
• virtual-network
• virtual-network-gateway
• virtual-network-gateway-connection
• virtual-network-manager
• virtual-network-peering
• virtual-wan
• vmware-private-cloud
• vpn-gateway
• vpn-site
• web-application-firewall-policy
• web-pubsub
• windows-function-app
• windows-virtual-machine
• windows-virtual-machine-scale-set
• windows-web-app

azure.concept.route-table Source

An Azure route table controlling subnet traffic paths.

Used by route-server, route-table.

azure.concept.security-detail Source

A certificate, access policy, alert, connector, or security configuration.

Used by 8 Rules

• advanced-threat-protection
• key-vault-access-policy
• key-vault-certificate
• sentinel-automation-rule
• sentinel-aws-cloudtrail-connector
• sentinel-entra-connector
• sentinel-nrt-alert-rule
• sentinel-scheduled-alert-rule

azure.concept.serverless-function Source

A managed event-driven function runtime.

Used by 6 Rules

• event-grid-event-subscription
• event-grid-system-topic-subscription
• flex-consumption-function-app
• function-app-function
• linux-function-app
• windows-function-app

azure.concept.service-bus-topic Source

An Azure Service Bus topic owning durable subscriptions.

Used by 4 Rules

• event-grid-event-subscription
• event-grid-system-topic-subscription
• service-bus-subscription
• service-bus-topic

azure.concept.service-fabric-cluster Source

An Azure Service Fabric cluster running distributed applications.

Used by managed-service-fabric-cluster, service-fabric-cluster.

azure.concept.service-identity-binding Source

An access-control binding that contributes to a service identity.

No Rule in this Dialect uses this definition.

azure.concept.site-recovery-detail Source

A recovery plan, mapping, replicated machine, or protection configuration.

Used by backup-protected-vm, site-recovery-plan, site-recovery-replicated-vm.

azure.concept.site-recovery-fabric Source

An Azure Site Recovery source or target fabric.

Used by site-recovery-fabric, site-recovery-protection-container.

azure.concept.spring-app Source

An application deployed in Azure Spring Apps.

Used by spring-app, spring-apps-gateway.

azure.concept.spring-apps-service Source

An Azure Spring Apps service boundary.

Used by spring-apps-service.

azure.concept.sql-server Source

An Azure SQL logical server owning managed databases.

Used by mssql-database, mssql-server.

azure.concept.sre-agent Source

An Azure SRE Agent operating against explicitly assigned Azure resources.

Used by sre-agent.

azure.concept.static-web-app Source

An Azure Static Web Apps site with managed hosting and APIs.

Used by static-web-app.

azure.concept.storage-account Source

An Azure Storage account owning data services and their security boundary.

Used by 10 Rules

• azure-files-share
• blob-container
• data-lake-filesystem
• event-grid-event-subscription
• event-grid-system-topic-subscription
• queue-storage-queue
• storage-account
• storage-encryption-scope
• storage-management-policy
• table-storage-table

azure.concept.storage-object-detail Source

An object, path, directory, table entity, or policy inside Azure Storage.

Used by 7 Rules

• data-lake-path
• storage-blob
• storage-encryption-scope
• storage-management-policy
• storage-share-directory
• storage-share-file
• storage-table-entity

azure.concept.storage-sync-service Source

An Azure File Sync service synchronizing file servers and Azure Files.

Used by storage-sync-service.

azure.concept.stream-analytics-job Source

An Azure Stream Analytics streaming query job.

Used by stream-analytics-job.

azure.concept.synapse-workspace Source

An Azure Synapse Analytics workspace.

Used by synapse-workspace.

azure.concept.table-storage-table Source

An Azure Table Storage table.

Used by storage-table-entity, table-storage-table.

azure.concept.third-party-monitor Source

A third-party observability service managed through Azure.

Used by 4 Rules

• datadog-monitor
• dynatrace-monitor
• elastic-cloud
• new-relic-monitor

azure.concept.traffic-manager-profile Source

An Azure Traffic Manager DNS traffic-routing profile.

Used by traffic-manager-profile.

azure.concept.trusted-signing-account Source

An Azure Artifact Signing account.

Used by trusted-signing-account.

azure.concept.video-indexer-account Source

An Azure AI Video Indexer account.

Used by video-indexer-account.

azure.concept.virtual-desktop-application-group Source

An Azure Virtual Desktop desktop or RemoteApp publication group.

Used by virtual-desktop-application-group.

azure.concept.virtual-desktop-host-pool Source

An Azure Virtual Desktop host pool providing session hosts.

Used by virtual-desktop-host-pool.

azure.concept.virtual-desktop-workspace Source

An Azure Virtual Desktop workspace publishing application groups.

Used by virtual-desktop-workspace.

azure.concept.virtual-hub Source

An Azure Virtual WAN regional transit hub.

Used by virtual-hub.

azure.concept.virtual-machine-scale-set Source

An Azure-managed group of virtual machines that scales as one compute workload.

Used by 4 Rules

• linux-virtual-machine-scale-set
• orchestrated-virtual-machine-scale-set
• virtual-machine-scale-set
• windows-virtual-machine-scale-set

azure.concept.virtual-network-manager Source

An Azure Virtual Network Manager control plane for network groups and policy.

Used by virtual-network-manager.

azure.concept.virtual-wan Source

An Azure Virtual WAN global transit network.

Used by virtual-wan.

azure.concept.vmware-private-cloud Source

An Azure VMware Solution private cloud.

Used by vmware-private-cloud.

azure.concept.vpn-connection Source

A virtual private network connection between network endpoints.

Used by virtual-network-gateway-connection, vpn-gateway-connection.

azure.concept.vpn-gateway Source

A managed gateway terminating virtual private network connections.

Used by point-to-site-vpn-gateway, virtual-network-gateway, vpn-gateway.

azure.concept.web-application-firewall-policy Source

A reusable Azure Web Application Firewall policy applied to Application Gateway traffic.

Used by application-gateway, web-application-firewall-policy.

azure.concept.workflow Source

A managed workflow coordinating steps and service calls.

Used by 4 Rules

• automation-runbook
• data-factory-pipeline
• logic-app-standard
• logic-app-workflow

Contexts

azure.context.ownership Source

Administrative or lifecycle ownership.

Used by 257 Rules

• ai-foundry
• ai-search-service
• ai-services-account
• aks-cluster
• analysis-services-server
• api-management
• api-management-standalone-gateway
• app-configuration
• app-service-environment
• app-service-plan
• application-gateway
• application-insights
• application-load-balancer
• arc-custom-location
• arc-enabled-server
• arc-kubernetes-cluster
• arc-private-link-scope
• arc-provisioned-kubernetes-cluster
• arc-resource-bridge
• attestation-provider
• automatic-kubernetes-cluster
• automation-account
• automation-runbook
• azure-bot
• azure-cache-for-redis
• azure-files-share
• azure-firewall
• azure-local-cluster
• azure-managed-redis
• bastion-host
• batch-account
• blob-container
• bot-channels-registration
• bot-web-app
• cdn-endpoint
• cdn-profile
• chaos-studio-experiment
• classic-front-door
• communication-service
• compute-gallery
• compute-image
• confidential-ledger
• container-app
• container-app-environment
• container-app-job
• container-instance-group
• container-registry
• cosmos-account
• cosmos-cassandra-cluster
• cosmos-cassandra-keyspace
• cosmos-gremlin-database
• cosmos-mongo-database
• cosmos-postgresql-cluster
• cosmos-sql-container
• cosmos-sql-database
• custom-ip-prefix
• data-box-edge-device
• data-explorer-cluster
• data-factory
• data-lake-filesystem
• data-protection-backup-vault
• data-share-account
• database-migration-project
• database-migration-service
• databricks-virtual-network-peering
• databricks-workspace
• datadog-monitor
• ddos-protection-plan
• dedicated-hardware-security-module
• dedicated-host-group
• dev-center
• dev-center-project
• dev-test-lab
• dev-test-linux-virtual-machine
• dev-test-windows-virtual-machine
• digital-twins-instance
• disk-snapshot
• dns-a-record
• dns-aaaa-record
• dns-cname-record
• dns-mx-record
• dns-ns-record
• dns-ptr-record
• dns-srv-record
• dns-txt-record
• dns-zone
• dynatrace-monitor
• elastic-cloud
• elastic-san
• email-communication-service
• entra-domain-services
• entra-external-id-directory
• event-grid-domain
• event-grid-domain-topic
• event-grid-event-subscription
• event-grid-namespace
• event-grid-namespace-topic
• event-grid-partner-namespace
• event-grid-system-topic
• event-grid-system-topic-subscription
• event-grid-topic
• event-hub
• event-hubs-cluster
• event-hubs-consumer-group
• event-hubs-namespace
• expressroute-circuit
• expressroute-gateway
• expressroute-port
• fabric-capacity
• file-share-backup-policy
• flex-consumption-function-app
• fluid-relay
• front-door-profile
• graph-data-connect-account
• hdinsight-hadoop-cluster
• hdinsight-hbase-cluster
• hdinsight-interactive-query-cluster
• hdinsight-kafka-cluster
• hdinsight-spark-cluster
• health-bot
• health-data-fhir-service
• health-data-services-workspace
• healthcare-service
• iot-central-application
• iot-hub
• iot-hub-device-provisioning-service
• iot-hub-device-update-account
• key-vault
• key-vault-key
• key-vault-secret
• kubernetes-fleet
• linux-function-app
• linux-virtual-machine
• linux-virtual-machine-scale-set
• linux-web-app
• load-balancer
• load-test
• local-network-gateway
• log-analytics-cluster
• log-analytics-solution
• log-analytics-workspace
• logic-app-integration-account
• logic-app-standard
• logic-app-workflow
• machine-learning-workspace
• maintenance-configuration
• managed-application
• managed-devops-pool
• managed-disk
• managed-grafana
• managed-hsm
• managed-hsm-key
• managed-lustre-file-system
• managed-service-fabric-cluster
• maps-account
• mongo-cluster
• monitor-private-link-scope
• monitor-workspace
• mssql-database
• mssql-server
• mysql-database
• mysql-flexible-server
• nat-gateway
• netapp-account
• netapp-backup-policy
• netapp-backup-vault
• netapp-capacity-pool
• netapp-volume
• network-function-traffic-collector
• network-security-group
• network-security-perimeter
• network-watcher
• new-relic-monitor
• nginx-deployment
• notification-hub
• notification-hubs-namespace
• oracle-autonomous-database
• oracle-cloud-vm-cluster
• oracle-exadata-infrastructure
• oracle-resource-anchor
• orchestrated-virtual-machine-scale-set
• palo-alto-firewall
• playwright-workspace
• point-to-site-vpn-gateway
• postgresql-flexible-server
• power-bi-embedded-capacity
• private-dns-a-record
• private-dns-cname-record
• private-dns-resolver
• private-dns-zone
• private-dns-zone-vnet-link
• private-endpoint
• private-link-service
• public-address
• public-ip-prefix
• purview-account
• queue-storage-queue
• qumulo-file-system
• recovery-services-vault
• red-hat-openshift-cluster
• relay-hybrid-connection
• relay-namespace
• route-server
• route-table
• sap-discovery-virtual-instance
• sap-single-node-virtual-instance
• sap-three-tier-virtual-instance
• service-bus-namespace
• service-bus-queue
• service-bus-subscription
• service-bus-topic
• service-fabric-cluster
• shared-image
• signalr-service
• site-recovery-fabric
• site-recovery-protection-container
• spring-app
• spring-apps-service
• sql-managed-instance
• stack-hci-virtual-hard-disk
• static-web-app
• storage-account
• storage-mover
• storage-sync-service
• stream-analytics-cluster
• stream-analytics-job
• subnet
• synapse-private-link-hub
• synapse-workspace
• system-center-vmm-server
• table-storage-table
• traffic-manager-profile
• trusted-signing-account
• user-assigned-managed-identity
• video-indexer-account
• virtual-desktop-application-group
• virtual-desktop-host-pool
• virtual-desktop-workspace
• virtual-hub
• virtual-machine
• virtual-machine-backup-policy
• virtual-machine-scale-set
• virtual-network
• virtual-network-gateway
• virtual-network-gateway-connection
• virtual-network-manager
• virtual-network-peering
• virtual-wan
• vmware-private-cloud
• vpn-gateway
• vpn-site
• web-application-firewall-policy
• web-pubsub
• windows-function-app
• windows-virtual-machine
• windows-virtual-machine-scale-set
• windows-web-app

Relations

azure.relation.delivers-to Source

Introduced by a labeled emission. Used by event-grid-event-subscription, event-grid-system-topic-subscription.

azure.relation.observed-by Source

Introduced by a labeled emission.

Used by 5 Rules

• aks-cluster
• application-insights
• container-app-environment
• linux-function-app
• windows-function-app

azure.relation.peers-with Source

Introduced by a labeled emission. Used by virtual-network-peering.

azure.relation.private-name-resolution Source

Introduced by a labeled emission. Used by postgresql-flexible-server.

azure.relation.subscribes-to Source

Introduced by a labeled emission. Used by event-grid-event-subscription, event-grid-system-topic-subscription, service-bus-subscription.

azure.relation.uses-waf-policy Source

Introduced by a labeled emission. Used by application-gateway.

RF Vocabulary used

• rf.concept.kubernetes-cluster
• rf.concept.managed-database
• rf.concept.object-storage-container
• rf.concept.service-identity
• rf.concept.subnet
• rf.concept.virtual-network
• rf.context.network
• rf.context.runtime

Rule details

Open a Rule for its declared behavior and source. Matching, emission resolution and composition define how evidence can establish it.

azure.rule.azure-enclave Source

Matches resource instances of azapi_resource.

Classification: azure.concept.azure-enclave.

Conditions, identity and resolution

Condition

RF

source.type == "Microsoft.Mission/virtualEnclaves@2026-03-01-preview"

azure.rule.horizondb-cluster Source

Matches resource instances of azapi_resource.

Classification: rf.concept.managed-database.

Conditions, identity and resolution

Condition

RF

source.type == "Microsoft.HorizonDb/clusters@2026-01-20-preview"

azure.rule.sre-agent Source

Matches resource instances of azapi_resource.

Classification: azure.concept.sre-agent.

Conditions, identity and resolution

Condition

RF

source.type == "Microsoft.App/agents@2026-01-01"

azure.rule.entra-access-package-assignment-policy Source

Matches resource instances of azuread_access_package_assignment_policy.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-app-role-assignment Source

Matches resource instances of azuread_app_role_assignment.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-application-federated-identity Source

Matches resource instances of azuread_application_federated_identity_credential.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-application-registration Source

Matches resource instances of azuread_application_registration.

Classification: azure.concept.entra-application.

azure.rule.entra-application Source

Matches resource instances of azuread_application.

Classification: azure.concept.entra-application.

azure.rule.entra-authentication-strength-policy Source

Matches resource instances of azuread_authentication_strength_policy.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-group-without-members Source

Matches resource instances of azuread_group_without_members.

Classification: azure.concept.identity-group.

azure.rule.entra-group Source

Matches resource instances of azuread_group.

Classification: azure.concept.identity-group.

azure.rule.entra-named-location Source

Matches resource instances of azuread_named_location.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-service-principal Source

Matches resource instances of azuread_service_principal.

Classification: rf.concept.service-identity.

Conditions, identity and resolution

Identity

• attributes: ["client_id"]
• scope: "provider"

Endpoint

• attributes: ["client_id"]

azure.rule.entra-external-id-directory Source

Matches resource instances of azurerm_aadb2c_directory.

Classification: azure.concept.entra-directory.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.entra-domain-services-replica-set Source

Matches resource instances of azurerm_active_directory_domain_service_replica_set.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-domain-services-trust Source

Matches resource instances of azurerm_active_directory_domain_service_trust.

Classification: azure.concept.identity-governance-detail.

azure.rule.entra-domain-services Source

Matches resource instances of azurerm_active_directory_domain_service.

Classification: azure.concept.entra-domain-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.advanced-threat-protection Source

Matches resource instances of azurerm_advanced_threat_protection.

Classification: azure.concept.security-detail.

azure.rule.ai-foundry-project Source

Matches resource instances of azurerm_ai_foundry_project.

Classification: azure.concept.ai-foundry.

azure.rule.ai-foundry Source

Matches resource instances of azurerm_ai_foundry.

Classification: azure.concept.ai-foundry.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.analysis-services-server Source

Matches resource instances of azurerm_analysis_services_server.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.api-connection Source

Matches resource instances of azurerm_api_connection.

Classification: azure.concept.integration-connection.

azure.rule.api-management-api Source

Matches resource instances of azurerm_api_management_api.

Classification: azure.concept.api-management-detail.

azure.rule.api-management-backend Source

Matches resource instances of azurerm_api_management_backend.

Classification: azure.concept.api-management-detail.

azure.rule.api-management-gateway Source

Matches resource instances of azurerm_api_management_gateway.

Classification: azure.concept.api-management-detail.

azure.rule.api-management-policy Source

Matches resource instances of azurerm_api_management_policy.

Classification: azure.concept.api-management-detail.

azure.rule.api-management-product Source

Matches resource instances of azurerm_api_management_product.

Classification: azure.concept.api-management-detail.

azure.rule.api-management-standalone-gateway Source

Matches resource instances of azurerm_api_management_standalone_gateway.

Classification: azure.concept.api-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.api-management-workspace Source

Matches resource instances of azurerm_api_management_workspace.

Classification: azure.concept.api-management-detail.

azure.rule.api-management Source

Matches resource instances of azurerm_api_management.

Classification: azure.concept.api-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.app-configuration Source

Matches resource instances of azurerm_app_configuration.

Classification: azure.concept.app-configuration.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.app-service-connection Source

Matches resource instances of azurerm_app_service_connection.

Classification: azure.concept.integration-connection.

azure.rule.app-service-environment Source

Matches resource instances of azurerm_app_service_environment_v3.

Classification: azure.concept.app-service-environment.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.application-gateway Source

Matches resource instances of azurerm_application_gateway.

Classification: azure.concept.load-balancer.

Contexts

• rf.context.network: targets rf.concept.subnet through source.gateway_ip_configuration[0].subnet_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Relations

• azure.relation.uses-waf-policy: targets azure.concept.web-application-firewall-policy through source.firewall_policy_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.gateway_ip_configuration[0].subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Relation through source.firewall_policy_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.application-insights-web-test Source

Matches resource instances of azurerm_application_insights_standard_web_test.

Classification: azure.concept.operations-detail.

azure.rule.application-insights Source

Matches resource instances of azurerm_application_insights.

Classification: azure.concept.application-insights.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Relations

• azure.relation.observed-by: targets azure.concept.log-analytics-workspace through source.workspace_id.

Conditions, identity and resolution

Identity

• attributes: ["id", "connection_string"]
• scope: "provider"

Endpoint

• attributes: ["id", "connection_string", "instrumentation_key"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Relation through source.workspace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.application-load-balancer-frontend Source

Matches resource instances of azurerm_application_load_balancer_frontend.

Classification: azure.concept.load-balancer-component.

azure.rule.application-load-balancer Source

Matches resource instances of azurerm_application_load_balancer.

Classification: azure.concept.load-balancer.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.application-security-group Source

Matches resource instances of azurerm_application_security_group.

Classification: azure.concept.network-policy-detail.

azure.rule.arc-kubernetes-cluster Source

Matches resource instances of azurerm_arc_kubernetes_cluster.

Classification: rf.concept.kubernetes-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.arc-provisioned-kubernetes-cluster Source

Matches resource instances of azurerm_arc_kubernetes_provisioned_cluster.

Classification: rf.concept.kubernetes-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.arc-enabled-server Source

Matches resource instances of azurerm_arc_machine.

Classification: azure.concept.arc-enabled-server.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.arc-private-link-scope Source

Matches resource instances of azurerm_arc_private_link_scope.

Classification: azure.concept.private-link-scope.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.arc-resource-bridge Source

Matches resource instances of azurerm_arc_resource_bridge_appliance.

Classification: azure.concept.arc-resource-bridge.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.attestation-provider Source

Matches resource instances of azurerm_attestation_provider.

Classification: azure.concept.attestation-provider.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.automation-account Source

Matches resource instances of azurerm_automation_account.

Classification: azure.concept.automation-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.automation-runbook Source

Matches resource instances of azurerm_automation_runbook.

Classification: azure.concept.workflow.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.automation-schedule Source

Matches resource instances of azurerm_automation_schedule.

Classification: azure.concept.operations-detail.

azure.rule.availability-set Source

Matches resource instances of azurerm_availability_set.

Classification: azure.concept.compute-placement.

azure.rule.file-share-backup-policy Source

Matches resource instances of azurerm_backup_policy_file_share.

Classification: azure.concept.backup-plan.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-machine-backup-policy Source

Matches resource instances of azurerm_backup_policy_vm.

Classification: azure.concept.backup-plan.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.backup-protected-vm Source

Matches resource instances of azurerm_backup_protected_vm.

Classification: azure.concept.site-recovery-detail.

azure.rule.bastion-host Source

Matches resource instances of azurerm_bastion_host.

Classification: azure.concept.bastion-host.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.batch-account Source

Matches resource instances of azurerm_batch_account.

Classification: azure.concept.batch-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.batch-application Source

Matches resource instances of azurerm_batch_application.

Classification: azure.concept.batch-pool.

azure.rule.batch-pool Source

Matches resource instances of azurerm_batch_pool.

Classification: azure.concept.batch-pool.

azure.rule.bot-channels-registration Source

Matches resource instances of azurerm_bot_channels_registration.

Classification: azure.concept.bot-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.azure-bot Source

Matches resource instances of azurerm_bot_service_azure_bot.

Classification: azure.concept.bot-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.bot-web-app Source

Matches resource instances of azurerm_bot_web_app.

Classification: azure.concept.bot-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.capacity-reservation-group Source

Matches resource instances of azurerm_capacity_reservation_group.

Classification: azure.concept.compute-placement.

azure.rule.capacity-reservation Source

Matches resource instances of azurerm_capacity_reservation.

Classification: azure.concept.compute-placement.

azure.rule.cdn-endpoint Source

Matches resource instances of azurerm_cdn_endpoint.

Classification: azure.concept.content-delivery-profile.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.front-door-endpoint Source

Matches resource instances of azurerm_cdn_frontdoor_endpoint.

Classification: azure.concept.load-balancer-component.

azure.rule.front-door-origin-group Source

Matches resource instances of azurerm_cdn_frontdoor_origin_group.

Classification: azure.concept.load-balancer-component.

azure.rule.front-door-origin Source

Matches resource instances of azurerm_cdn_frontdoor_origin.

Classification: azure.concept.load-balancer-component.

azure.rule.front-door-profile Source

Matches resource instances of azurerm_cdn_frontdoor_profile.

Classification: azure.concept.front-door-profile.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.front-door-route Source

Matches resource instances of azurerm_cdn_frontdoor_route.

Classification: azure.concept.load-balancer-component.

azure.rule.cdn-profile Source

Matches resource instances of azurerm_cdn_profile.

Classification: azure.concept.content-delivery-profile.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.chaos-studio-experiment Source

Matches resource instances of azurerm_chaos_studio_experiment.

Classification: azure.concept.chaos-experiment.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.ai-services-project Source

Matches resource instances of azurerm_cognitive_account_project.

Classification: azure.concept.ai-foundry.

azure.rule.ai-services-account Source

Matches resource instances of azurerm_cognitive_account.

Classification: azure.concept.ai-service-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.ai-model-deployment Source

Matches resource instances of azurerm_cognitive_deployment.

Classification: azure.concept.ai-inference-endpoint.

azure.rule.communication-service Source

Matches resource instances of azurerm_communication_service.

Classification: azure.concept.communication-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.confidential-ledger Source

Matches resource instances of azurerm_confidential_ledger.

Classification: azure.concept.confidential-ledger.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.container-app-environment Source

Matches resource instances of azurerm_container_app_environment.

Classification: azure.concept.container-app-environment.

Contexts

• rf.context.network: targets rf.concept.subnet through source.infrastructure_subnet_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Relations

• azure.relation.observed-by: targets azure.concept.log-analytics-workspace through source.log_analytics_workspace_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.infrastructure_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Relation through source.log_analytics_workspace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.container-app-job Source

Matches resource instances of azurerm_container_app_job.

Classification: azure.concept.container-app-job.

Contexts

• rf.context.runtime: targets azure.concept.container-app-environment through source.container_app_environment_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.container_app_environment_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.container-app Source

Matches resource instances of azurerm_container_app.

Classification: azure.concept.container-app.

Contexts

• rf.context.runtime: targets azure.concept.container-app-environment through source.container_app_environment_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.container_app_environment_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.connected-container-registry Source

Matches resource instances of azurerm_container_connected_registry.

Classification: azure.concept.container-registry.

azure.rule.container-instance-group Source

Matches resource instances of azurerm_container_group.

Classification: azure.concept.container-instance-group.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.container-registry Source

Matches resource instances of azurerm_container_registry.

Classification: azure.concept.container-registry.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-account Source

Matches resource instances of azurerm_cosmosdb_account.

Classification: azure.concept.cosmos-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-cassandra-cluster Source

Matches resource instances of azurerm_cosmosdb_cassandra_cluster.

Classification: rf.concept.managed-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-cassandra-keyspace Source

Matches resource instances of azurerm_cosmosdb_cassandra_keyspace.

Classification: azure.concept.logical-database.

Contexts

• azure.context.ownership: targets azure.concept.cosmos-account through source.account_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.account_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-cassandra-table Source

Matches resource instances of azurerm_cosmosdb_cassandra_table.

Classification: azure.concept.database-component.

Contributions

• targets azure.concept.logical-database through source.cassandra_keyspace_id.

Conditions, identity and resolution

Contribution through source.cassandra_keyspace_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.cosmos-gremlin-database Source

Matches resource instances of azurerm_cosmosdb_gremlin_database.

Classification: azure.concept.logical-database.

Contexts

• azure.context.ownership: targets azure.concept.cosmos-account through source.account_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.account_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-gremlin-graph Source

Matches resource instances of azurerm_cosmosdb_gremlin_graph.

Classification: azure.concept.database-component.

Contributions

• targets azure.concept.logical-database through source.database_name.

Conditions, identity and resolution

Contribution through source.database_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-mongo-collection Source

Matches resource instances of azurerm_cosmosdb_mongo_collection.

Classification: azure.concept.database-component.

Contributions

• targets azure.concept.logical-database through source.database_name.

Conditions, identity and resolution

Contribution through source.database_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-mongo-database Source

Matches resource instances of azurerm_cosmosdb_mongo_database.

Classification: azure.concept.logical-database.

Contexts

• azure.context.ownership: targets azure.concept.cosmos-account through source.account_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.account_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-postgresql-cluster Source

Matches resource instances of azurerm_cosmosdb_postgresql_cluster.

Classification: rf.concept.managed-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-sql-container Source

Matches resource instances of azurerm_cosmosdb_sql_container.

Classification: azure.concept.database-component.

Contexts

• azure.context.ownership: targets azure.concept.logical-database through source.database_name.

Contributions

• targets azure.concept.logical-database through source.database_name.

Conditions, identity and resolution

Context through source.database_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.database_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-sql-database Source

Matches resource instances of azurerm_cosmosdb_sql_database.

Classification: azure.concept.logical-database.

Contexts

• azure.context.ownership: targets azure.concept.cosmos-account through source.account_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.account_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.cosmos-dedicated-gateway Source

Matches resource instances of azurerm_cosmosdb_sql_dedicated_gateway.

Classification: azure.concept.database-component.

Contributions

• targets azure.concept.cosmos-account through source.cosmosdb_account_id.

Conditions, identity and resolution

Contribution through source.cosmosdb_account_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.custom-ip-prefix Source

Matches resource instances of azurerm_custom_ip_prefix.

Classification: azure.concept.public-address.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-grafana Source

Matches resource instances of azurerm_dashboard_grafana.

Classification: azure.concept.managed-grafana.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.data-factory-data-flow Source

Matches resource instances of azurerm_data_factory_data_flow.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory-blob-dataset Source

Matches resource instances of azurerm_data_factory_dataset_azure_blob.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory-sql-dataset Source

Matches resource instances of azurerm_data_factory_dataset_azure_sql_table.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory-azure-integration-runtime Source

Matches resource instances of azurerm_data_factory_integration_runtime_azure.

Classification: azure.concept.data-integration-runtime.

azure.rule.data-factory-self-hosted-integration-runtime Source

Matches resource instances of azurerm_data_factory_integration_runtime_self_hosted.

Classification: azure.concept.data-integration-runtime.

azure.rule.data-factory-blob-linked-service Source

Matches resource instances of azurerm_data_factory_linked_service_azure_blob_storage.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory-sql-linked-service Source

Matches resource instances of azurerm_data_factory_linked_service_azure_sql_database.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory-managed-private-endpoint Source

Matches resource instances of azurerm_data_factory_managed_private_endpoint.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory-pipeline Source

Matches resource instances of azurerm_data_factory_pipeline.

Classification: azure.concept.workflow.

azure.rule.data-factory-schedule-trigger Source

Matches resource instances of azurerm_data_factory_trigger_schedule.

Classification: azure.concept.data-integration-detail.

azure.rule.data-factory Source

Matches resource instances of azurerm_data_factory.

Classification: azure.concept.data-factory.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.data-protection-blob-backup-policy Source

Matches resource instances of azurerm_data_protection_backup_policy_blob_storage.

Classification: azure.concept.backup-plan.

azure.rule.data-protection-disk-backup-policy Source

Matches resource instances of azurerm_data_protection_backup_policy_disk.

Classification: azure.concept.backup-plan.

azure.rule.data-protection-backup-vault Source

Matches resource instances of azurerm_data_protection_backup_vault.

Classification: azure.concept.backup-vault.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.data-share-account Source

Matches resource instances of azurerm_data_share_account.

Classification: azure.concept.data-share-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.database-migration-project Source

Matches resource instances of azurerm_database_migration_project.

Classification: azure.concept.migration-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.database-migration-service Source

Matches resource instances of azurerm_database_migration_service.

Classification: azure.concept.migration-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.data-box-edge-device Source

Matches resource instances of azurerm_databox_edge_device.

Classification: azure.concept.migration-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.databricks-virtual-network-peering Source

Matches resource instances of azurerm_databricks_virtual_network_peering.

Classification: azure.concept.network-peering.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.databricks-workspace Source

Matches resource instances of azurerm_databricks_workspace.

Classification: azure.concept.databricks-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.datadog-monitor Source

Matches resource instances of azurerm_datadog_monitor.

Classification: azure.concept.third-party-monitor.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dedicated-hardware-security-module Source

Matches resource instances of azurerm_dedicated_hardware_security_module.

Classification: azure.concept.managed-hsm.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dedicated-host-group Source

Matches resource instances of azurerm_dedicated_host_group.

Classification: azure.concept.dedicated-host-group.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dev-box-definition Source

Matches resource instances of azurerm_dev_center_dev_box_definition.

Classification: azure.concept.developer-environment.

azure.rule.dev-center-project Source

Matches resource instances of azurerm_dev_center_project.

Classification: azure.concept.dev-center-project.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dev-center Source

Matches resource instances of azurerm_dev_center.

Classification: azure.concept.dev-center.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dev-test-lab Source

Matches resource instances of azurerm_dev_test_lab.

Classification: azure.concept.developer-environment.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dev-test-linux-virtual-machine Source

Matches resource instances of azurerm_dev_test_linux_virtual_machine.

Classification: azure.concept.compute-instance.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dev-test-windows-virtual-machine Source

Matches resource instances of azurerm_dev_test_windows_virtual_machine.

Classification: azure.concept.compute-instance.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.digital-twins-event-grid-endpoint Source

Matches resource instances of azurerm_digital_twins_endpoint_eventgrid.

Classification: azure.concept.iot-detail.

azure.rule.digital-twins-instance Source

Matches resource instances of azurerm_digital_twins_instance.

Classification: azure.concept.digital-twins-instance.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-a-record Source

Matches resource instances of azurerm_dns_a_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-aaaa-record Source

Matches resource instances of azurerm_dns_aaaa_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-cname-record Source

Matches resource instances of azurerm_dns_cname_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-mx-record Source

Matches resource instances of azurerm_dns_mx_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-ns-record Source

Matches resource instances of azurerm_dns_ns_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-ptr-record Source

Matches resource instances of azurerm_dns_ptr_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-srv-record Source

Matches resource instances of azurerm_dns_srv_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-txt-record Source

Matches resource instances of azurerm_dns_txt_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.zone_name.

Contributions

• targets azure.concept.dns-zone through source.zone_name.

Conditions, identity and resolution

Context through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.zone_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dns-zone Source

Matches resource instances of azurerm_dns_zone.

Classification: azure.concept.dns-zone.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.dynatrace-monitor Source

Matches resource instances of azurerm_dynatrace_monitor.

Classification: azure.concept.third-party-monitor.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.elastic-cloud Source

Matches resource instances of azurerm_elastic_cloud_elasticsearch.

Classification: azure.concept.third-party-monitor.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.elastic-san-volume-group Source

Matches resource instances of azurerm_elastic_san_volume_group.

Classification: azure.concept.elastic-san.

azure.rule.elastic-san-volume Source

Matches resource instances of azurerm_elastic_san_volume.

Classification: azure.concept.block-storage-volume.

azure.rule.elastic-san Source

Matches resource instances of azurerm_elastic_san.

Classification: azure.concept.elastic-san.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.email-communication-service Source

Matches resource instances of azurerm_email_communication_service.

Classification: azure.concept.email-communication-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-grid-domain-topic Source

Matches resource instances of azurerm_eventgrid_domain_topic.

Classification: azure.concept.event-grid-topic.

Contexts

• azure.context.ownership: targets azure.concept.event-grid-domain through source.domain_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.domain_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-grid-domain Source

Matches resource instances of azurerm_eventgrid_domain.

Classification: azure.concept.event-grid-domain.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-grid-event-subscription Source

Matches resource instances of azurerm_eventgrid_event_subscription.

Classification: azure.concept.message-subscription.

Contexts

• azure.context.ownership: targets azure.concept.event-grid-topic through source.scope.

Relations

• azure.relation.subscribes-to: targets azure.concept.event-grid-topic through source.scope.
• azure.relation.delivers-to: targets azure.concept.event-stream through source.eventhub_id.
• azure.relation.delivers-to: targets azure.concept.message-queue through source.service_bus_queue_id.
• azure.relation.delivers-to: targets azure.concept.service-bus-topic through source.service_bus_topic_id.
• azure.relation.delivers-to: targets azure.concept.serverless-function through source.azure_function_endpoint[0].function_id.
• azure.relation.delivers-to: targets azure.concept.storage-account through source.storage_queue_endpoint[0].storage_account_id.

Conditions, identity and resolution

Context through source.scope

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.scope

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.eventhub_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.service_bus_queue_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.service_bus_topic_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.azure_function_endpoint[0].function_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.storage_queue_endpoint[0].storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.event-grid-namespace-topic Source

Matches resource instances of azurerm_eventgrid_namespace_topic.

Classification: azure.concept.message-topic.

Contexts

• azure.context.ownership: targets azure.concept.event-grid-domain through source.eventgrid_namespace_id.

Conditions, identity and resolution

Context through source.eventgrid_namespace_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.event-grid-namespace Source

Matches resource instances of azurerm_eventgrid_namespace.

Classification: azure.concept.event-grid-domain.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-grid-partner-namespace Source

Matches resource instances of azurerm_eventgrid_partner_namespace.

Classification: azure.concept.event-grid-domain.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-grid-system-topic-subscription Source

Matches resource instances of azurerm_eventgrid_system_topic_event_subscription.

Classification: azure.concept.message-subscription.

Contexts

• azure.context.ownership: targets azure.rule.event-grid-system-topic through source.system_topic.

Relations

• azure.relation.subscribes-to: targets azure.rule.event-grid-system-topic through source.system_topic.
• azure.relation.delivers-to: targets azure.concept.event-stream through source.eventhub_id.
• azure.relation.delivers-to: targets azure.concept.message-queue through source.service_bus_queue_id.
• azure.relation.delivers-to: targets azure.concept.service-bus-topic through source.service_bus_topic_id.
• azure.relation.delivers-to: targets azure.concept.serverless-function through source.azure_function_endpoint[0].function_id.
• azure.relation.delivers-to: targets azure.concept.storage-account through source.storage_queue_endpoint[0].storage_account_id.

Conditions, identity and resolution

Context through source.system_topic

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

Relation through source.system_topic

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

Relation through source.eventhub_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.service_bus_queue_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.service_bus_topic_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.azure_function_endpoint[0].function_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.storage_queue_endpoint[0].storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.event-grid-system-topic Source

Matches resource instances of azurerm_eventgrid_system_topic.

Classification: azure.concept.event-grid-topic.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-grid-topic Source

Matches resource instances of azurerm_eventgrid_topic.

Classification: azure.concept.event-grid-topic.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-hubs-cluster Source

Matches resource instances of azurerm_eventhub_cluster.

Classification: azure.concept.event-stream.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-hubs-consumer-group Source

Matches resource instances of azurerm_eventhub_consumer_group.

Classification: azure.concept.messaging-detail.

Contexts

• azure.context.ownership: targets azure.concept.event-stream through source.eventhub_name.

Contributions

• targets azure.concept.event-stream through source.eventhub_name.

Conditions, identity and resolution

Context through source.eventhub_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.eventhub_name

• on_null: "absent"
• on_empty: "absent"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-hubs-schema-group Source

Matches resource instances of azurerm_eventhub_namespace_schema_group.

Classification: azure.concept.messaging-detail.

Contributions

• targets azure.concept.messaging-namespace through source.namespace_id.

Conditions, identity and resolution

Contribution through source.namespace_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.event-hubs-namespace Source

Matches resource instances of azurerm_eventhub_namespace.

Classification: azure.concept.messaging-namespace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.event-hub Source

Matches resource instances of azurerm_eventhub.

Classification: azure.concept.event-stream.

Contexts

• azure.context.ownership: targets azure.concept.messaging-namespace through source.namespace_id.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.namespace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.expressroute-circuit Source

Matches resource instances of azurerm_express_route_circuit.

Classification: azure.concept.dedicated-interconnect.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.expressroute-gateway Source

Matches resource instances of azurerm_express_route_gateway.

Classification: azure.concept.expressroute-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.expressroute-port Source

Matches resource instances of azurerm_express_route_port.

Classification: azure.concept.dedicated-interconnect.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.arc-custom-location Source

Matches resource instances of azurerm_extended_location_custom_location.

Classification: azure.concept.custom-location.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.fabric-capacity Source

Matches resource instances of azurerm_fabric_capacity.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.azure-firewall-policy-rule-collection-group Source

Matches resource instances of azurerm_firewall_policy_rule_collection_group.

Classification: azure.concept.firewall-policy.

azure.rule.azure-firewall-policy Source

Matches resource instances of azurerm_firewall_policy.

Classification: azure.concept.firewall-policy.

azure.rule.azure-firewall Source

Matches resource instances of azurerm_firewall.

Classification: azure.concept.azure-firewall.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.fluid-relay Source

Matches resource instances of azurerm_fluid_relay_server.

Classification: azure.concept.realtime-communication-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.classic-front-door Source

Matches resource instances of azurerm_frontdoor.

Classification: azure.concept.front-door-profile.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.flex-consumption-function-app Source

Matches resource instances of azurerm_function_app_flex_consumption.

Classification: azure.concept.serverless-function.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.
• rf.context.network: targets rf.concept.subnet through source.virtual_network_subnet_id.
• rf.context.runtime: targets azure.concept.app-service-plan through source.service_plan_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.virtual_network_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.service_plan_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.function-app-function Source

Matches resource instances of azurerm_function_app_function.

Classification: azure.concept.serverless-function.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

azure.rule.graph-data-connect-account Source

Matches resource instances of azurerm_graph_services_account.

Classification: azure.concept.graph-data-connect-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.hdinsight-hadoop-cluster Source

Matches resource instances of azurerm_hdinsight_hadoop_cluster.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.hdinsight-hbase-cluster Source

Matches resource instances of azurerm_hdinsight_hbase_cluster.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.hdinsight-interactive-query-cluster Source

Matches resource instances of azurerm_hdinsight_interactive_query_cluster.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.hdinsight-kafka-cluster Source

Matches resource instances of azurerm_hdinsight_kafka_cluster.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.hdinsight-spark-cluster Source

Matches resource instances of azurerm_hdinsight_spark_cluster.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.health-bot Source

Matches resource instances of azurerm_healthbot.

Classification: azure.concept.bot-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.health-data-dicom-service Source

Matches resource instances of azurerm_healthcare_dicom_service.

Classification: azure.concept.health-data-service.

azure.rule.health-data-fhir-service Source

Matches resource instances of azurerm_healthcare_fhir_service.

Classification: azure.concept.health-data-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.health-data-medtech-service Source

Matches resource instances of azurerm_healthcare_medtech_service.

Classification: azure.concept.health-data-service.

azure.rule.healthcare-service Source

Matches resource instances of azurerm_healthcare_service.

Classification: azure.concept.health-data-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.health-data-services-workspace Source

Matches resource instances of azurerm_healthcare_workspace.

Classification: azure.concept.health-data-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.compute-image Source

Matches resource instances of azurerm_image.

Classification: azure.concept.compute-image.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.iot-central-application Source

Matches resource instances of azurerm_iotcentral_application.

Classification: azure.concept.iot-central-application.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.iot-hub-device-update-account Source

Matches resource instances of azurerm_iothub_device_update_account.

Classification: azure.concept.iot-update-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.iot-hub-device-update-instance Source

Matches resource instances of azurerm_iothub_device_update_instance.

Classification: azure.concept.iot-detail.

azure.rule.iot-hub-device-provisioning-service Source

Matches resource instances of azurerm_iothub_dps.

Classification: azure.concept.iot-provisioning-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.iot-hub-event-hubs-endpoint Source

Matches resource instances of azurerm_iothub_endpoint_eventhub.

Classification: azure.concept.iot-detail.

azure.rule.iot-hub-service-bus-queue-endpoint Source

Matches resource instances of azurerm_iothub_endpoint_servicebus_queue.

Classification: azure.concept.iot-detail.

azure.rule.iot-hub-storage-endpoint Source

Matches resource instances of azurerm_iothub_endpoint_storage_container.

Classification: azure.concept.iot-detail.

azure.rule.iot-hub Source

Matches resource instances of azurerm_iothub.

Classification: azure.concept.iot-hub.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.ip-group Source

Matches resource instances of azurerm_ip_group.

Classification: azure.concept.network-policy-detail.

azure.rule.key-vault-access-policy Source

Matches resource instances of azurerm_key_vault_access_policy.

Classification: azure.concept.security-detail.

Contributions

• targets azure.concept.key-vault through source.key_vault_id.

Conditions, identity and resolution

Contribution through source.key_vault_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.key-vault-certificate Source

Matches resource instances of azurerm_key_vault_certificate.

Classification: azure.concept.security-detail.

Contributions

• targets azure.concept.key-vault through source.key_vault_id.

Conditions, identity and resolution

Contribution through source.key_vault_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.key-vault-key Source

Matches resource instances of azurerm_key_vault_key.

Classification: azure.concept.encryption-key.

Contexts

• azure.context.ownership: targets azure.concept.key-vault through source.key_vault_id.

Conditions, identity and resolution

Context through source.key_vault_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.managed-hsm-key Source

Matches resource instances of azurerm_key_vault_managed_hardware_security_module_key.

Classification: azure.concept.encryption-key.

Contexts

• azure.context.ownership: targets azure.concept.managed-hsm through source.managed_hsm_id.

Conditions, identity and resolution

Context through source.managed_hsm_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.managed-hsm Source

Matches resource instances of azurerm_key_vault_managed_hardware_security_module.

Classification: azure.concept.managed-hsm.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.key-vault-secret Source

Matches resource instances of azurerm_key_vault_secret.

Classification: azure.concept.managed-secret.

Contexts

• azure.context.ownership: targets azure.concept.key-vault through source.key_vault_id.

Conditions, identity and resolution

Context through source.key_vault_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.key-vault Source

Matches resource instances of azurerm_key_vault.

Classification: azure.concept.key-vault.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.automatic-kubernetes-cluster Source

Matches resource instances of azurerm_kubernetes_automatic_cluster.

Classification: rf.concept.kubernetes-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.aks-node-pool Source

Matches resource instances of azurerm_kubernetes_cluster_node_pool.

Classification: azure.concept.kubernetes-node-pool.

Contexts

• rf.context.network: targets rf.concept.subnet through source.vnet_subnet_id.

Contributions

• targets rf.concept.kubernetes-cluster through source.kubernetes_cluster_id.

Conditions, identity and resolution

Context through source.vnet_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.kubernetes_cluster_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.aks-cluster Source

Matches resource instances of azurerm_kubernetes_cluster.

Classification: rf.concept.kubernetes-cluster.

Contexts

• rf.context.network: targets rf.concept.subnet through source.default_node_pool[0].vnet_subnet_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Relations

• azure.relation.observed-by: targets azure.concept.log-analytics-workspace through source.oms_agent[0].log_analytics_workspace_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id", "kube_config[0].host", "kube_admin_config[0].host"]

Context through source.default_node_pool[0].vnet_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Relation through source.oms_agent[0].log_analytics_workspace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.kubernetes-fleet Source

Matches resource instances of azurerm_kubernetes_fleet_manager.

Classification: azure.concept.kubernetes-fleet.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.data-explorer-cluster Source

Matches resource instances of azurerm_kusto_cluster.

Classification: azure.concept.data-explorer-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.data-explorer-event-grid-connection Source

Matches resource instances of azurerm_kusto_eventgrid_data_connection.

Classification: azure.concept.database-component.

azure.rule.data-explorer-event-hubs-connection Source

Matches resource instances of azurerm_kusto_eventhub_data_connection.

Classification: azure.concept.database-component.

azure.rule.load-balancer-backend-pool Source

Matches resource instances of azurerm_lb_backend_address_pool.

Classification: azure.concept.load-balancer-component.

Contributions

• targets azure.concept.load-balancer through source.loadbalancer_id.

Conditions, identity and resolution

Contribution through source.loadbalancer_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.load-balancer-nat-rule Source

Matches resource instances of azurerm_lb_nat_rule.

Classification: azure.concept.load-balancer-component.

azure.rule.load-balancer-outbound-rule Source

Matches resource instances of azurerm_lb_outbound_rule.

Classification: azure.concept.load-balancer-component.

azure.rule.load-balancer-probe Source

Matches resource instances of azurerm_lb_probe.

Classification: azure.concept.load-balancer-component.

azure.rule.load-balancer-rule Source

Matches resource instances of azurerm_lb_rule.

Classification: azure.concept.load-balancer-component.

Contributions

• targets azure.concept.load-balancer through source.loadbalancer_id.

Conditions, identity and resolution

Contribution through source.loadbalancer_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.load-balancer Source

Matches resource instances of azurerm_lb.

Classification: azure.concept.load-balancer.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.lighthouse-definition Source

Matches resource instances of azurerm_lighthouse_definition.

Classification: azure.concept.governance-detail.

azure.rule.linux-function-app Source

Matches resource instances of azurerm_linux_function_app.

Classification: azure.concept.serverless-function.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.
• rf.context.network: targets rf.concept.subnet through source.virtual_network_subnet_id.
• rf.context.runtime: targets azure.concept.app-service-plan through source.service_plan_id.

Relations

• azure.relation.observed-by: targets azure.concept.application-insights through source.site_config[0].application_insights_connection_string.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.virtual_network_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.service_plan_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.site_config[0].application_insights_connection_string

• on_null: "absent"
• on_empty: "absent"
• match.by: target.connection_string
• match.strategy: "exact"

azure.rule.linux-virtual-machine-scale-set Source

Matches resource instances of azurerm_linux_virtual_machine_scale_set.

Classification: azure.concept.virtual-machine-scale-set.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.linux-virtual-machine Source

Matches resource instances of azurerm_linux_virtual_machine.

Classification: azure.concept.compute-instance.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.linux-web-app Source

Matches resource instances of azurerm_linux_web_app.

Classification: azure.concept.app-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.
• rf.context.network: targets rf.concept.subnet through source.virtual_network_subnet_id.
• rf.context.runtime: targets azure.concept.app-service-plan through source.service_plan_id.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.virtual_network_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.service_plan_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.load-test Source

Matches resource instances of azurerm_load_test.

Classification: azure.concept.load-test.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.local-network-gateway Source

Matches resource instances of azurerm_local_network_gateway.

Classification: azure.concept.local-network-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.log-analytics-cluster Source

Matches resource instances of azurerm_log_analytics_cluster.

Classification: azure.concept.log-analytics-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.log-analytics-data-export-rule Source

Matches resource instances of azurerm_log_analytics_data_export_rule.

Classification: azure.concept.operations-detail.

Contributions

• targets azure.concept.log-analytics-workspace through source.workspace_resource_id.

Conditions, identity and resolution

Contribution through source.workspace_resource_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.log-analytics-saved-search Source

Matches resource instances of azurerm_log_analytics_saved_search.

Classification: azure.concept.operations-detail.

Contributions

• targets azure.concept.log-analytics-workspace through source.log_analytics_workspace_id.

Conditions, identity and resolution

Contribution through source.log_analytics_workspace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.log-analytics-solution Source

Matches resource instances of azurerm_log_analytics_solution.

Classification: azure.concept.operations-detail.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Contributions

• targets azure.concept.log-analytics-workspace through source.workspace_resource_id.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Contribution through source.workspace_resource_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.log-analytics-workspace-table Source

Matches resource instances of azurerm_log_analytics_workspace_table.

Classification: azure.concept.operations-detail.

Contributions

• targets azure.concept.log-analytics-workspace through source.workspace_id.

Conditions, identity and resolution

Contribution through source.workspace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.log-analytics-workspace Source

Matches resource instances of azurerm_log_analytics_workspace.

Classification: azure.concept.log-analytics-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.logic-app-http-action Source

Matches resource instances of azurerm_logic_app_action_http.

Classification: azure.concept.api-management-detail.

azure.rule.logic-app-integration-account Source

Matches resource instances of azurerm_logic_app_integration_account.

Classification: azure.concept.integration-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.logic-app-standard Source

Matches resource instances of azurerm_logic_app_standard.

Classification: azure.concept.workflow.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.logic-app-recurrence-trigger Source

Matches resource instances of azurerm_logic_app_trigger_recurrence.

Classification: azure.concept.api-management-detail.

azure.rule.logic-app-workflow Source

Matches resource instances of azurerm_logic_app_workflow.

Classification: azure.concept.workflow.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.machine-learning-compute-cluster Source

Matches resource instances of azurerm_machine_learning_compute_cluster.

Classification: azure.concept.machine-learning-compute.

azure.rule.machine-learning-compute-instance Source

Matches resource instances of azurerm_machine_learning_compute_instance.

Classification: azure.concept.machine-learning-compute.

azure.rule.machine-learning-inference-cluster Source

Matches resource instances of azurerm_machine_learning_inference_cluster.

Classification: azure.concept.ai-inference-endpoint.

azure.rule.machine-learning-workspace Source

Matches resource instances of azurerm_machine_learning_workspace.

Classification: azure.concept.machine-learning-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.maintenance-configuration Source

Matches resource instances of azurerm_maintenance_configuration.

Classification: azure.concept.maintenance-configuration.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-application Source

Matches resource instances of azurerm_managed_application.

Classification: azure.concept.managed-application.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-devops-pool Source

Matches resource instances of azurerm_managed_devops_pool.

Classification: azure.concept.developer-environment.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-disk Source

Matches resource instances of azurerm_managed_disk.

Classification: azure.concept.block-storage-volume.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-lustre-file-system Source

Matches resource instances of azurerm_managed_lustre_file_system.

Classification: azure.concept.managed-file-storage.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-redis-geo-replication Source

Matches resource instances of azurerm_managed_redis_geo_replication.

Classification: azure.concept.database-component.

azure.rule.azure-managed-redis Source

Matches resource instances of azurerm_managed_redis.

Classification: azure.concept.managed-cache.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.maps-account Source

Matches resource instances of azurerm_maps_account.

Classification: azure.concept.maps-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.mongo-cluster Source

Matches resource instances of azurerm_mongo_cluster.

Classification: rf.concept.managed-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.monitor-action-group Source

Matches resource instances of azurerm_monitor_action_group.

Classification: azure.concept.operations-detail.

azure.rule.monitor-data-collection-endpoint Source

Matches resource instances of azurerm_monitor_data_collection_endpoint.

Classification: azure.concept.operations-detail.

azure.rule.monitor-diagnostic-setting Source

Matches resource instances of azurerm_monitor_diagnostic_setting.

Classification: azure.concept.operations-detail.

azure.rule.monitor-metric-alert Source

Matches resource instances of azurerm_monitor_metric_alert.

Classification: azure.concept.operations-detail.

azure.rule.monitor-private-link-scope Source

Matches resource instances of azurerm_monitor_private_link_scope.

Classification: azure.concept.private-link-scope.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.monitor-scheduled-query-alert Source

Matches resource instances of azurerm_monitor_scheduled_query_rules_alert_v2.

Classification: azure.concept.operations-detail.

azure.rule.monitor-workspace Source

Matches resource instances of azurerm_monitor_workspace.

Classification: azure.concept.monitor-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.mssql-database Source

Matches resource instances of azurerm_mssql_database.

Classification: azure.concept.logical-database.

Contexts

• azure.context.ownership: targets azure.concept.sql-server through source.server_id.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.server_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.sql-elastic-pool Source

Matches resource instances of azurerm_mssql_elasticpool.

Classification: azure.concept.database-component.

azure.rule.sql-failover-group Source

Matches resource instances of azurerm_mssql_failover_group.

Classification: azure.concept.database-component.

azure.rule.sql-managed-database Source

Matches resource instances of azurerm_mssql_managed_database.

Classification: azure.concept.logical-database.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

azure.rule.sql-managed-instance Source

Matches resource instances of azurerm_mssql_managed_instance.

Classification: rf.concept.managed-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.mssql-server Source

Matches resource instances of azurerm_mssql_server.

Classification: azure.concept.sql-server.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.mysql-database Source

Matches resource instances of azurerm_mysql_flexible_database.

Classification: azure.concept.logical-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.mysql-flexible-server Source

Matches resource instances of azurerm_mysql_flexible_server.

Classification: rf.concept.managed-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.nat-gateway-public-ip-association Source

Matches resource instances of azurerm_nat_gateway_public_ip_association.

Classification: azure.concept.network-policy-detail.

Contributions

• targets azure.concept.managed-nat through source.nat_gateway_id.
• targets azure.concept.public-address through source.public_ip_address_id.

Conditions, identity and resolution

Contribution through source.nat_gateway_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.public_ip_address_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.nat-gateway-public-ip-prefix-association Source

Matches resource instances of azurerm_nat_gateway_public_ip_prefix_association.

Classification: azure.concept.network-policy-detail.

Contributions

• targets azure.concept.managed-nat through source.nat_gateway_id.
• targets azure.concept.public-address through source.public_ip_prefix_id.

Conditions, identity and resolution

Contribution through source.nat_gateway_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.public_ip_prefix_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.nat-gateway Source

Matches resource instances of azurerm_nat_gateway.

Classification: azure.concept.managed-nat.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.netapp-account Source

Matches resource instances of azurerm_netapp_account.

Classification: azure.concept.netapp-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.netapp-backup-policy Source

Matches resource instances of azurerm_netapp_backup_policy.

Classification: azure.concept.backup-plan.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.netapp-backup-vault Source

Matches resource instances of azurerm_netapp_backup_vault.

Classification: azure.concept.backup-vault.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.netapp-capacity-pool Source

Matches resource instances of azurerm_netapp_pool.

Classification: azure.concept.netapp-capacity-pool.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.netapp-volume Source

Matches resource instances of azurerm_netapp_volume.

Classification: azure.concept.managed-file-storage.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.ddos-protection-plan Source

Matches resource instances of azurerm_network_ddos_protection_plan.

Classification: azure.concept.ddos-protection-plan.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.network-function-traffic-collector Source

Matches resource instances of azurerm_network_function_azure_traffic_collector.

Classification: azure.concept.network-function-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.network-manager-ipam-pool Source

Matches resource instances of azurerm_network_manager_ipam_pool.

Classification: azure.concept.network-policy-detail.

azure.rule.virtual-network-manager Source

Matches resource instances of azurerm_network_manager.

Classification: azure.concept.virtual-network-manager.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.network-security-group Source

Matches resource instances of azurerm_network_security_group.

Classification: azure.concept.network-security-group.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.network-security-perimeter Source

Matches resource instances of azurerm_network_security_perimeter.

Classification: azure.concept.network-security-perimeter.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.network-security-rule Source

Matches resource instances of azurerm_network_security_rule.

Classification: azure.concept.network-policy-detail.

azure.rule.network-watcher-flow-log Source

Matches resource instances of azurerm_network_watcher_flow_log.

Classification: azure.concept.operations-detail.

azure.rule.network-watcher Source

Matches resource instances of azurerm_network_watcher.

Classification: azure.concept.network-watcher.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.new-relic-monitor Source

Matches resource instances of azurerm_new_relic_monitor.

Classification: azure.concept.third-party-monitor.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.nginx-deployment Source

Matches resource instances of azurerm_nginx_deployment.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.notification-hubs-namespace Source

Matches resource instances of azurerm_notification_hub_namespace.

Classification: azure.concept.notification-namespace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.notification-hub Source

Matches resource instances of azurerm_notification_hub.

Classification: azure.concept.notification-hub.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.oracle-autonomous-database Source

Matches resource instances of azurerm_oracle_autonomous_database.

Classification: rf.concept.managed-database.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.oracle-cloud-vm-cluster Source

Matches resource instances of azurerm_oracle_cloud_vm_cluster.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.oracle-exadata-infrastructure Source

Matches resource instances of azurerm_oracle_exadata_infrastructure.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.oracle-resource-anchor Source

Matches resource instances of azurerm_oracle_resource_anchor.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.orchestrated-virtual-machine-scale-set Source

Matches resource instances of azurerm_orchestrated_virtual_machine_scale_set.

Classification: azure.concept.virtual-machine-scale-set.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.palo-alto-firewall Source

Matches resource instances of azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.playwright-workspace Source

Matches resource instances of azurerm_playwright_workspace.

Classification: azure.concept.developer-environment.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.point-to-site-vpn-gateway Source

Matches resource instances of azurerm_point_to_site_vpn_gateway.

Classification: azure.concept.vpn-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.policy-definition Source

Matches resource instances of azurerm_policy_definition.

Classification: azure.concept.governance-detail.

azure.rule.policy-set-definition Source

Matches resource instances of azurerm_policy_set_definition.

Classification: azure.concept.governance-detail.

azure.rule.portal-dashboard Source

Matches resource instances of azurerm_portal_dashboard.

Classification: azure.concept.operations-detail.

azure.rule.postgresql-backup Source

Matches resource instances of azurerm_postgresql_flexible_server_backup.

Classification: azure.concept.database-component.

azure.rule.postgresql-database Source

Matches resource instances of azurerm_postgresql_flexible_server_database.

Classification: azure.concept.logical-database.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

azure.rule.postgresql-flexible-server Source

Matches resource instances of azurerm_postgresql_flexible_server.

Classification: rf.concept.managed-database.

Contexts

• rf.context.network: targets rf.concept.subnet through source.delegated_subnet_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Relations

• azure.relation.private-name-resolution: targets azure.concept.dns-zone through source.private_dns_zone_id.

Conditions, identity and resolution

Context through source.delegated_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Relation through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.power-bi-embedded-capacity Source

Matches resource instances of azurerm_powerbi_embedded.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.private-dns-a-record Source

Matches resource instances of azurerm_private_dns_a_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.private_dns_zone_id.

Contributions

• targets azure.concept.dns-zone through source.private_dns_zone_id.

Conditions, identity and resolution

Context through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.private-dns-cname-record Source

Matches resource instances of azurerm_private_dns_cname_record.

Classification: azure.concept.dns-record.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.private_dns_zone_id.

Contributions

• targets azure.concept.dns-zone through source.private_dns_zone_id.

Conditions, identity and resolution

Context through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.private-dns-forwarding-ruleset Source

Matches resource instances of azurerm_private_dns_resolver_dns_forwarding_ruleset.

Classification: azure.concept.private-network-link.

azure.rule.private-dns-inbound-endpoint Source

Matches resource instances of azurerm_private_dns_resolver_inbound_endpoint.

Classification: azure.concept.private-network-link.

azure.rule.private-dns-outbound-endpoint Source

Matches resource instances of azurerm_private_dns_resolver_outbound_endpoint.

Classification: azure.concept.private-network-link.

azure.rule.private-dns-resolver Source

Matches resource instances of azurerm_private_dns_resolver.

Classification: azure.concept.private-dns-resolver.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.private-dns-zone-vnet-link Source

Matches resource instances of azurerm_private_dns_zone_virtual_network_link.

Classification: azure.concept.private-network-link.

Contexts

• azure.context.ownership: targets azure.concept.dns-zone through source.private_dns_zone_id.

Contributions

• targets azure.concept.dns-zone through source.private_dns_zone_id.
• targets rf.concept.virtual-network through source.virtual_network_id.

Conditions, identity and resolution

Context through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.private_dns_zone_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.virtual_network_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.private-dns-zone Source

Matches resource instances of azurerm_private_dns_zone.

Classification: azure.concept.dns-zone.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.private-endpoint Source

Matches resource instances of azurerm_private_endpoint.

Classification: azure.concept.private-endpoint.

Contexts

• rf.context.network: targets rf.concept.subnet through source.subnet_id.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.private-link-service Source

Matches resource instances of azurerm_private_link_service.

Classification: azure.concept.private-link-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.proximity-placement-group Source

Matches resource instances of azurerm_proximity_placement_group.

Classification: azure.concept.compute-placement.

azure.rule.public-ip-prefix Source

Matches resource instances of azurerm_public_ip_prefix.

Classification: azure.concept.public-address.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.public-address Source

Matches resource instances of azurerm_public_ip.

Classification: azure.concept.public-address.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.purview-account Source

Matches resource instances of azurerm_purview_account.

Classification: azure.concept.purview-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.qumulo-file-system Source

Matches resource instances of azurerm_qumulo_file_system.

Classification: azure.concept.managed-file-storage.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.recovery-services-vault Source

Matches resource instances of azurerm_recovery_services_vault.

Classification: azure.concept.backup-vault.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.red-hat-openshift-cluster Source

Matches resource instances of azurerm_redhat_openshift_cluster.

Classification: rf.concept.kubernetes-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.azure-cache-for-redis Source

Matches resource instances of azurerm_redis_cache.

Classification: azure.concept.managed-cache.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.relay-hybrid-connection Source

Matches resource instances of azurerm_relay_hybrid_connection.

Classification: azure.concept.relay-connection.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.relay-namespace Source

Matches resource instances of azurerm_relay_namespace.

Classification: azure.concept.relay-namespace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.resource-group Source

Matches resource instances of azurerm_resource_group.

Classification: azure.concept.resource-group.

Conditions, identity and resolution

Identity

• attributes: ["name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

azure.rule.resource-policy-assignment Source

Matches resource instances of azurerm_resource_policy_assignment.

Classification: azure.concept.governance-detail.

azure.rule.role-assignment Source

Matches resource instances of azurerm_role_assignment.

Classification: azure.concept.governance-detail.

azure.rule.role-definition Source

Matches resource instances of azurerm_role_definition.

Classification: azure.concept.governance-detail.

azure.rule.route-server Source

Matches resource instances of azurerm_route_server.

Classification: azure.concept.route-table.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.route-table Source

Matches resource instances of azurerm_route_table.

Classification: azure.concept.route-table.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.route Source

Matches resource instances of azurerm_route.

Classification: azure.concept.network-policy-detail.

azure.rule.ai-search-service Source

Matches resource instances of azurerm_search_service.

Classification: azure.concept.ai-search-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.defender-subscription-plan Source

Matches resource instances of azurerm_security_center_subscription_pricing.

Classification: azure.concept.defender-plan.

azure.rule.defender-workspace Source

Matches resource instances of azurerm_security_center_workspace.

Classification: azure.concept.defender-plan.

azure.rule.sentinel-nrt-alert-rule Source

Matches resource instances of azurerm_sentinel_alert_rule_nrt.

Classification: azure.concept.security-detail.

azure.rule.sentinel-scheduled-alert-rule Source

Matches resource instances of azurerm_sentinel_alert_rule_scheduled.

Classification: azure.concept.security-detail.

azure.rule.sentinel-automation-rule Source

Matches resource instances of azurerm_sentinel_automation_rule.

Classification: azure.concept.security-detail.

azure.rule.sentinel-aws-cloudtrail-connector Source

Matches resource instances of azurerm_sentinel_data_connector_aws_cloud_trail.

Classification: azure.concept.security-detail.

azure.rule.sentinel-entra-connector Source

Matches resource instances of azurerm_sentinel_data_connector_azure_active_directory.

Classification: azure.concept.security-detail.

azure.rule.service-fabric-cluster Source

Matches resource instances of azurerm_service_fabric_cluster.

Classification: azure.concept.service-fabric-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.managed-service-fabric-cluster Source

Matches resource instances of azurerm_service_fabric_managed_cluster.

Classification: azure.concept.service-fabric-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.app-service-plan Source

Matches resource instances of azurerm_service_plan.

Classification: azure.concept.app-service-plan.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.service-bus-namespace Source

Matches resource instances of azurerm_servicebus_namespace.

Classification: azure.concept.messaging-namespace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.service-bus-queue Source

Matches resource instances of azurerm_servicebus_queue.

Classification: azure.concept.message-queue.

Contexts

• azure.context.ownership: targets azure.concept.messaging-namespace through source.namespace_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.namespace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.service-bus-subscription-rule Source

Matches resource instances of azurerm_servicebus_subscription_rule.

Classification: azure.concept.messaging-detail.

azure.rule.service-bus-subscription Source

Matches resource instances of azurerm_servicebus_subscription.

Classification: azure.concept.message-subscription.

Contexts

• azure.context.ownership: targets azure.concept.service-bus-topic through source.topic_id.

Relations

• azure.relation.subscribes-to: targets azure.concept.service-bus-topic through source.topic_id.

Conditions, identity and resolution

Context through source.topic_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.topic_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.service-bus-topic Source

Matches resource instances of azurerm_servicebus_topic.

Classification: azure.concept.service-bus-topic.

Contexts

• azure.context.ownership: targets azure.concept.messaging-namespace through source.namespace_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.namespace_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.compute-gallery Source

Matches resource instances of azurerm_shared_image_gallery.

Classification: azure.concept.image-gallery.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.shared-image Source

Matches resource instances of azurerm_shared_image.

Classification: azure.concept.compute-image.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.signalr-service Source

Matches resource instances of azurerm_signalr_service.

Classification: azure.concept.realtime-communication-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.site-recovery-fabric Source

Matches resource instances of azurerm_site_recovery_fabric.

Classification: azure.concept.site-recovery-fabric.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.site-recovery-protection-container Source

Matches resource instances of azurerm_site_recovery_protection_container.

Classification: azure.concept.site-recovery-fabric.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.site-recovery-replicated-vm Source

Matches resource instances of azurerm_site_recovery_replicated_vm.

Classification: azure.concept.site-recovery-detail.

azure.rule.site-recovery-plan Source

Matches resource instances of azurerm_site_recovery_replication_recovery_plan.

Classification: azure.concept.site-recovery-detail.

azure.rule.disk-snapshot Source

Matches resource instances of azurerm_snapshot.

Classification: azure.concept.disk-snapshot.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.spring-app Source

Matches resource instances of azurerm_spring_cloud_app.

Classification: azure.concept.spring-app.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.spring-apps-gateway Source

Matches resource instances of azurerm_spring_cloud_gateway.

Classification: azure.concept.spring-app.

azure.rule.spring-apps-service Source

Matches resource instances of azurerm_spring_cloud_service.

Classification: azure.concept.spring-apps-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.azure-local-cluster Source

Matches resource instances of azurerm_stack_hci_cluster.

Classification: azure.concept.azure-local-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.stack-hci-virtual-hard-disk Source

Matches resource instances of azurerm_stack_hci_virtual_hard_disk.

Classification: azure.concept.block-storage-volume.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.static-web-app Source

Matches resource instances of azurerm_static_web_app.

Classification: azure.concept.static-web-app.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.storage-account Source

Matches resource instances of azurerm_storage_account.

Classification: azure.concept.storage-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.storage-blob Source

Matches resource instances of azurerm_storage_blob.

Classification: azure.concept.storage-object-detail.

Contributions

• targets rf.concept.object-storage-container through source.storage_container_id.

Conditions, identity and resolution

Contribution through source.storage_container_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.blob-container Source

Matches resource instances of azurerm_storage_container.

Classification: rf.concept.object-storage-container.

Contexts

• azure.context.ownership: targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.data-lake-filesystem Source

Matches resource instances of azurerm_storage_data_lake_gen2_filesystem.

Classification: rf.concept.object-storage-container.

Contexts

• azure.context.ownership: targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.data-lake-path Source

Matches resource instances of azurerm_storage_data_lake_gen2_path.

Classification: azure.concept.storage-object-detail.

azure.rule.storage-encryption-scope Source

Matches resource instances of azurerm_storage_encryption_scope.

Classification: azure.concept.storage-object-detail.

Contributions

• targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Contribution through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.storage-management-policy Source

Matches resource instances of azurerm_storage_management_policy.

Classification: azure.concept.storage-object-detail.

Contributions

• targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Contribution through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.storage-mover Source

Matches resource instances of azurerm_storage_mover.

Classification: azure.concept.migration-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.queue-storage-queue Source

Matches resource instances of azurerm_storage_queue.

Classification: azure.concept.message-queue.

Contexts

• azure.context.ownership: targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.storage-share-directory Source

Matches resource instances of azurerm_storage_share_directory.

Classification: azure.concept.storage-object-detail.

azure.rule.storage-share-file Source

Matches resource instances of azurerm_storage_share_file.

Classification: azure.concept.storage-object-detail.

azure.rule.azure-files-share Source

Matches resource instances of azurerm_storage_share.

Classification: azure.concept.managed-file-storage.

Contexts

• azure.context.ownership: targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Context through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.storage-sync-service Source

Matches resource instances of azurerm_storage_sync.

Classification: azure.concept.storage-sync-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.storage-table-entity Source

Matches resource instances of azurerm_storage_table_entity.

Classification: azure.concept.storage-object-detail.

Contributions

• targets azure.concept.table-storage-table through source.storage_table_id.

Conditions, identity and resolution

Contribution through source.storage_table_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.table-storage-table Source

Matches resource instances of azurerm_storage_table.

Classification: azure.concept.table-storage-table.

Contexts

• azure.context.ownership: targets azure.concept.storage-account through source.storage_account_id.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.storage_account_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.stream-analytics-cluster Source

Matches resource instances of azurerm_stream_analytics_cluster.

Classification: azure.concept.analytics-cluster.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.stream-analytics-job Source

Matches resource instances of azurerm_stream_analytics_job.

Classification: azure.concept.stream-analytics-job.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.stream-analytics-blob-output Source

Matches resource instances of azurerm_stream_analytics_output_blob.

Classification: azure.concept.data-integration-detail.

azure.rule.stream-analytics-event-hubs-input Source

Matches resource instances of azurerm_stream_analytics_stream_input_eventhub_v2.

Classification: azure.concept.data-integration-detail.

azure.rule.subnet-nat-gateway-association Source

Matches resource instances of azurerm_subnet_nat_gateway_association.

Classification: azure.concept.network-policy-detail.

Contributions

• targets rf.concept.subnet through source.subnet_id.
• targets azure.concept.managed-nat through source.nat_gateway_id.

Conditions, identity and resolution

Contribution through source.subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Contribution through source.nat_gateway_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.subnet-network-security-group-association Source

Matches resource instances of azurerm_subnet_network_security_group_association.

Classification: azure.concept.network-policy-detail.

azure.rule.subnet-route-table-association Source

Matches resource instances of azurerm_subnet_route_table_association.

Classification: azure.concept.network-policy-detail.

azure.rule.subnet Source

Matches resource instances of azurerm_subnet.

Classification: rf.concept.subnet.

Contexts

• rf.context.network: targets rf.concept.virtual-network through source.virtual_network_name.
• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.virtual_network_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.synapse-private-link-hub Source

Matches resource instances of azurerm_synapse_private_link_hub.

Classification: azure.concept.private-link-scope.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.synapse-spark-pool Source

Matches resource instances of azurerm_synapse_spark_pool.

Classification: azure.concept.analytics-pool.

azure.rule.synapse-sql-pool Source

Matches resource instances of azurerm_synapse_sql_pool.

Classification: azure.concept.analytics-pool.

azure.rule.synapse-workspace Source

Matches resource instances of azurerm_synapse_workspace.

Classification: azure.concept.synapse-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.system-center-vmm-server Source

Matches resource instances of azurerm_system_center_virtual_machine_manager_server.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.system-center-virtual-machine Source

Matches resource instances of azurerm_system_center_virtual_machine_manager_virtual_machine_instance.

Classification: azure.concept.compute-instance.

azure.rule.traffic-manager-azure-endpoint Source

Matches resource instances of azurerm_traffic_manager_azure_endpoint.

Classification: azure.concept.load-balancer-component.

azure.rule.traffic-manager-profile Source

Matches resource instances of azurerm_traffic_manager_profile.

Classification: azure.concept.traffic-manager-profile.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.trusted-signing-account Source

Matches resource instances of azurerm_trusted_signing_account.

Classification: azure.concept.trusted-signing-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.user-assigned-managed-identity Source

Matches resource instances of azurerm_user_assigned_identity.

Classification: rf.concept.service-identity.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "principal_id", "client_id"]
• scope: "global"

Endpoint

• attributes: ["id", "principal_id", "client_id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.video-indexer-account Source

Matches resource instances of azurerm_video_indexer_account.

Classification: azure.concept.video-indexer-account.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-desktop-application-group Source

Matches resource instances of azurerm_virtual_desktop_application_group.

Classification: azure.concept.virtual-desktop-application-group.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-desktop-application Source

Matches resource instances of azurerm_virtual_desktop_application.

Classification: azure.concept.compute-placement.

azure.rule.virtual-desktop-host-pool Source

Matches resource instances of azurerm_virtual_desktop_host_pool.

Classification: azure.concept.virtual-desktop-host-pool.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-desktop-scaling-plan Source

Matches resource instances of azurerm_virtual_desktop_scaling_plan.

Classification: azure.concept.compute-placement.

azure.rule.virtual-desktop-workspace Source

Matches resource instances of azurerm_virtual_desktop_workspace.

Classification: azure.concept.virtual-desktop-workspace.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-hub Source

Matches resource instances of azurerm_virtual_hub.

Classification: azure.concept.virtual-hub.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-machine-restore-point Source

Matches resource instances of azurerm_virtual_machine_restore_point.

Classification: azure.concept.disk-snapshot.

azure.rule.virtual-machine-scale-set Source

Matches resource instances of azurerm_virtual_machine_scale_set.

Classification: azure.concept.virtual-machine-scale-set.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-machine Source

Matches resource instances of azurerm_virtual_machine.

Classification: azure.concept.compute-instance.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-network-gateway-connection Source

Matches resource instances of azurerm_virtual_network_gateway_connection.

Classification: azure.concept.vpn-connection.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-network-gateway Source

Matches resource instances of azurerm_virtual_network_gateway.

Classification: azure.concept.vpn-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-network-peering Source

Matches resource instances of azurerm_virtual_network_peering.

Classification: azure.concept.network-peering.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.
• rf.context.network: targets rf.concept.virtual-network through source.virtual_network_name.

Relations

• azure.relation.peers-with: targets rf.concept.virtual-network through source.remote_virtual_network_id.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.virtual_network_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Relation through source.remote_virtual_network_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

azure.rule.virtual-network Source

Matches resource instances of azurerm_virtual_network.

Classification: rf.concept.virtual-network.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id", "name"]
• scope: "provider"

Endpoint

• attributes: ["id", "name"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.virtual-wan Source

Matches resource instances of azurerm_virtual_wan.

Classification: azure.concept.virtual-wan.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.vmware-cluster Source

Matches resource instances of azurerm_vmware_cluster.

Classification: azure.concept.hybrid-platform.

azure.rule.vmware-private-cloud Source

Matches resource instances of azurerm_vmware_private_cloud.

Classification: azure.concept.vmware-private-cloud.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.vpn-gateway-connection Source

Matches resource instances of azurerm_vpn_gateway_connection.

Classification: azure.concept.vpn-connection.

azure.rule.vpn-gateway Source

Matches resource instances of azurerm_vpn_gateway.

Classification: azure.concept.vpn-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.vpn-site Source

Matches resource instances of azurerm_vpn_site.

Classification: azure.concept.local-network-gateway.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.web-application-firewall-policy Source

Matches resource instances of azurerm_web_application_firewall_policy.

Classification: azure.concept.web-application-firewall-policy.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.web-pubsub Source

Matches resource instances of azurerm_web_pubsub.

Classification: azure.concept.realtime-communication-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.windows-function-app Source

Matches resource instances of azurerm_windows_function_app.

Classification: azure.concept.serverless-function.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.
• rf.context.network: targets rf.concept.subnet through source.virtual_network_subnet_id.
• rf.context.runtime: targets azure.concept.app-service-plan through source.service_plan_id.

Relations

• azure.relation.observed-by: targets azure.concept.application-insights through source.site_config[0].application_insights_connection_string.

Conditions, identity and resolution

Identity

• attributes: ["id"]
• scope: "provider"

Endpoint

• attributes: ["id"]

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.virtual_network_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.service_plan_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

Relation through source.site_config[0].application_insights_connection_string

• on_null: "absent"
• on_empty: "absent"
• match.by: target.connection_string
• match.strategy: "exact"

azure.rule.windows-virtual-machine-scale-set Source

Matches resource instances of azurerm_windows_virtual_machine_scale_set.

Classification: azure.concept.virtual-machine-scale-set.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.windows-virtual-machine Source

Matches resource instances of azurerm_windows_virtual_machine.

Classification: azure.concept.compute-instance.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.windows-web-app Source

Matches resource instances of azurerm_windows_web_app.

Classification: azure.concept.app-service.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.
• rf.context.network: targets rf.concept.subnet through source.virtual_network_subnet_id.
• rf.context.runtime: targets azure.concept.app-service-plan through source.service_plan_id.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

Context through source.virtual_network_subnet_id

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.id
• match.strategy: "exact"

Context through source.service_plan_id

• on_null: "absent"
• on_empty: "absent"
• match.by: target.id
• match.strategy: "exact"

azure.rule.sap-discovery-virtual-instance Source

Matches resource instances of azurerm_workloads_sap_discovery_virtual_instance.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.sap-single-node-virtual-instance Source

Matches resource instances of azurerm_workloads_sap_single_node_virtual_instance.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"

azure.rule.sap-three-tier-virtual-instance Source

Matches resource instances of azurerm_workloads_sap_three_tier_virtual_instance.

Classification: azure.concept.hybrid-platform.

Contexts

• azure.context.ownership: targets azure.concept.resource-group through source.resource_group_name.

Conditions, identity and resolution

Context through source.resource_group_name

• on_null: "absent"
• on_empty: "absent"
• external: "allow"
• match.by: target.name
• match.strategy: "exact"