⭐ azure: roll out private endpoint connections, identity, and provenance

Expand security context across several Azure resources with three
verified additions. Each candidate was checked against its vendored SDK
first, so resources whose SDK cannot populate a field were left alone.

Private endpoint connections — add a typed
`privateEndpointConnections() []azure.subscription.privateEndpointConnection`
accessor to resources that lacked one:

- Service Bus namespace, Event Hubs namespace, IoT Hub, Cognitive
  Services account, App Configuration store, SignalR, Web PubSub, and
  Synapse workspace read the connections already embedded in the parent's
  properties (no extra API call).
- AKS cluster fetches them through the dedicated
  PrivateEndpointConnectionsClient, tolerating 404/403 as "none".
- API Management exposes the full typed list; its
  `privateEndpointConnectionCount` is deprecated in favor of it.

A shared helper (`private_endpoint_connections.go`) normalizes any SDK
connection type through a dict, since they all share the same JSON shape,
and gives the nested connection-state a derived id to avoid cache
collisions.

Managed identity — IoT Hub gains identityType, principalId, tenantId,
and userAssignedIdentities; API Management gains principalId, tenantId,
and userAssignedIdentities. Customer-managed-key encryption was
evaluated and is not exposed by either SDK, so it was not modeled.

Provenance — Purview account gains `systemMetadata()`, adding the ARM
last-modified provenance its bespoke createdAt/createdBy fields lack.

No new provider permissions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tas50

providers/azure/resources/aks.go

@@ -561,6 +561,38 @@ func (a *mqlAzureSubscriptionAksServiceClusterIdentityBinding) id() (string, err
 	return a.Id.Data, nil
 }
 
+func (a *mqlAzureSubscriptionAksServiceCluster) privateEndpointConnections() ([]any, error) {
+	conn := a.MqlRuntime.Connection.(*connection.AzureConnection)
+	ctx := context.Background()
+	token := conn.Token()
+
+	resourceID, err := ParseResourceID(a.Id.Data)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := clusters.NewPrivateEndpointConnectionsClient(resourceID.SubscriptionID, token, &arm.ClientOptions{
+		ClientOptions: conn.ClientOptions(),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := client.List(ctx, resourceID.ResourceGroup, a.Name.Data, nil)
+	if err != nil {
+		// Private endpoint connections are absent on clusters without private
+		// networking, and the endpoint returns 403 when the caller lacks
+		// access. Treat both as "no connections" rather than failing.
+		var respErr *azcore.ResponseError
+		if errors.As(err, &respErr) && (respErr.StatusCode == http.StatusNotFound || respErr.StatusCode == http.StatusForbidden) {
+			return []any{}, nil
+		}
+		return nil, err
+	}
+
+	return azurePrivateEndpointConnectionsToMql(a.MqlRuntime, resp.Value)
+}
+
 func (a *mqlAzureSubscriptionAksServiceCluster) identityBindings() ([]any, error) {
 	conn := a.MqlRuntime.Connection.(*connection.AzureConnection)
 	ctx := context.Background()

providers/azure/resources/apimanagement.go

@@ -23,8 +23,18 @@ import (
 )
 
 type mqlAzureSubscriptionApiManagementServiceServiceInternal struct {
-	cachePublicIpAddressId string
-	cacheSystemData        any
+	cachePublicIpAddressId          string
+	cacheSystemData                 any
+	cacheUserAssignedIdentityIds    []string
+	cachePrivateEndpointConnections []*apim.RemotePrivateEndpointConnectionWrapper
+}
+
+func (a *mqlAzureSubscriptionApiManagementServiceService) userAssignedIdentities() ([]any, error) {
+	return resolveUserAssignedIdentities(a.MqlRuntime, a.cacheUserAssignedIdentityIds)
+}
+
+func (a *mqlAzureSubscriptionApiManagementServiceService) privateEndpointConnections() ([]any, error) {
+	return azurePrivateEndpointConnectionsToMql(a.MqlRuntime, a.cachePrivateEndpointConnections)
 }
 
 // API Management encodes its gateway TLS protocol and cipher policy as
@@ -112,8 +122,15 @@ func (a *mqlAzureSubscriptionApiManagementService) services() ([]any, error) {
 			}
 
 			var identityType string
-			if svc.Identity != nil && svc.Identity.Type != nil {
-				identityType = string(*svc.Identity.Type)
+			var identityPrincipalId, identityTenantId *string
+			var userAssignedIdentityIds []string
+			if svc.Identity != nil {
+				if svc.Identity.Type != nil {
+					identityType = string(*svc.Identity.Type)
+				}
+				identityPrincipalId = svc.Identity.PrincipalID
+				identityTenantId = svc.Identity.TenantID
+				userAssignedIdentityIds = sortedUserAssignedIdentityIDs(svc.Identity.UserAssignedIdentities)
 			}
 
 			var (
@@ -285,6 +302,8 @@ func (a *mqlAzureSubscriptionApiManagementService) services() ([]any, error) {
 					"tripleDesEnabled":               llx.BoolDataPtr(tripleDesEnabled),
 					"http2Enabled":                   llx.BoolDataPtr(http2Enabled),
 					"identityType":                   llx.StringData(identityType),
+					"principalId":                    llx.StringDataPtr(identityPrincipalId),
+					"tenantId":                       llx.StringDataPtr(identityTenantId),
 					"publicIpAddresses":              llx.ArrayData(publicIpAddresses, types.String),
 					"privateIpAddresses":             llx.ArrayData(privateIpAddresses, types.String),
 					"outboundPublicIpAddresses":      llx.ArrayData(outboundPublicIpAddresses, types.String),
@@ -297,6 +316,10 @@ func (a *mqlAzureSubscriptionApiManagementService) services() ([]any, error) {
 			}
 			svcRes := mqlSvc.(*mqlAzureSubscriptionApiManagementServiceService)
 			svcRes.cachePublicIpAddressId = publicIpAddressId
+			svcRes.cacheUserAssignedIdentityIds = userAssignedIdentityIds
+			if p := svc.Properties; p != nil {
+				svcRes.cachePrivateEndpointConnections = p.PrivateEndpointConnections
+			}
 			sysData, err := convert.JsonToDict(svc.SystemData)
 			if err != nil {
 				return nil, err

providers/azure/resources/appconfiguration.go

@@ -163,9 +163,17 @@ func configurationStoreToMql(runtime *plugin.Runtime, store *armappconfiguration
 		return nil, err
 	}
 	mqlStore.cacheSystemData = sysData
+	if store.Properties != nil {
+		mqlStore.cachePrivateEndpointConnections = store.Properties.PrivateEndpointConnections
+	}
 	return mqlStore, nil
 }
 
 type mqlAzureSubscriptionAppConfigurationServiceConfigurationStoreInternal struct {
-	cacheSystemData any
+	cacheSystemData                 any
+	cachePrivateEndpointConnections []*armappconfiguration.PrivateEndpointConnectionReference
+}
+
+func (a *mqlAzureSubscriptionAppConfigurationServiceConfigurationStore) privateEndpointConnections() ([]any, error) {
+	return azurePrivateEndpointConnectionsToMql(a.MqlRuntime, a.cachePrivateEndpointConnections)
 }

providers/azure/resources/azure.lr

@@ -7816,6 +7816,8 @@ azure.subscription.aksService.cluster @defaults("name location kubernetesVersion
   kubeletIdentity() azure.subscription.managedIdentity
   // Client ID of the legacy service principal used by the cluster; empty when the cluster uses a managed identity
   servicePrincipalClientId string
+  // Private endpoint connections to the cluster API server
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Creation and last-modification provenance recorded by Azure Resource Manager
   systemMetadata() azure.subscription.systemData
   // Whether the AKS API server is reachable from the public internet
@@ -8246,6 +8248,16 @@ private azure.subscription.iotService.iotHub @defaults("id name location") {
   enableDataResidency bool
   // Network rule set: defaultAction, applyToBuiltInEventHubEndpoint, ipRules
   networkRuleSet dict
+  // Managed identity type ("None", "SystemAssigned", "UserAssigned", "SystemAssigned, UserAssigned")
+  identityType string
+  // Principal ID of the system-assigned managed identity
+  principalId string
+  // Tenant ID of the system-assigned managed identity
+  tenantId string
+  // User-assigned managed identities associated with the IoT hub
+  userAssignedIdentities() []azure.subscription.managedIdentity
+  // Private endpoint connections to the IoT hub
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Diagnostic settings configured on the IoT hub (forwarding logs and metrics to Log Analytics, storage, or Event Hub)
   diagnosticSettings() []azure.subscription.monitorService.diagnosticsetting
   // Creation and last-modification provenance recorded by Azure Resource Manager
@@ -8628,6 +8640,8 @@ azure.subscription.synapseService.workspace @defaults("name location") {
   cmkKey() azure.subscription.keyVaultService.key
   // User-assigned managed identities associated with the workspace
   userAssignedIdentities() []azure.subscription.managedIdentity
+  // Private endpoint connections to the workspace
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
 }
 
 // Azure Container Registry service
@@ -9595,6 +9609,8 @@ azure.subscription.serviceBusService.namespace @defaults("id name location") {
   queues() []azure.subscription.serviceBusService.namespace.queue
   // Topics in this namespace
   topics() []azure.subscription.serviceBusService.namespace.topic
+  // Private endpoint connections to the namespace
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // When the namespace was created
   creationTime time
   // Creation and last-modification provenance recorded by Azure Resource Manager
@@ -9783,6 +9799,8 @@ azure.subscription.eventHubService.namespace @defaults("id name location") {
   networkRules() azure.subscription.eventHubService.namespace.networkRules
   // Event Hubs in this namespace
   eventHubs() []azure.subscription.eventHubService.namespace.eventHub
+  // Private endpoint connections to the namespace
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // When the namespace was created
   creationTime time
   // Creation and last-modification provenance recorded by Azure Resource Manager
@@ -11023,14 +11041,24 @@ azure.subscription.apiManagementService.service @defaults("name location skuName
   http2Enabled bool
   // Identity type ("None", "SystemAssigned", "UserAssigned", "SystemAssigned, UserAssigned")
   identityType string
+  // Principal ID of the system-assigned managed identity
+  principalId string
+  // Tenant ID of the system-assigned managed identity
+  tenantId string
+  // User-assigned managed identities associated with the service
+  userAssignedIdentities() []azure.subscription.managedIdentity
   // Public load-balanced IPv4 addresses of the service in its primary region (Basic / Standard / Premium / Isolated SKUs)
   publicIpAddresses []string
   // Private load-balanced IPv4 addresses of the service in its primary region when deployed in an Internal VNet
   privateIpAddresses []string
   // Outbound public IPv4 prefixes associated with NAT Gateway-deployed services (Premium SKU on stv2)
   outboundPublicIpAddresses []string
   // Number of private endpoint connections to the service
-  privateEndpointConnectionCount int
+  //
+  // Deprecated in favor of `privateEndpointConnections`.
+  privateEndpointConnectionCount @maturity("deprecated") int
+  // Private endpoint connections to the service
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Availability zones the service is spread across
   zones []string
   // Public IP address attached to the service (null when not configured)
@@ -11106,6 +11134,8 @@ private azure.subscription.purviewService.account @defaults("name location publi
   createdBy string
   // Unmodeled raw properties returned by the Azure API
   properties dict
+  // Creation and last-modification provenance recorded by Azure Resource Manager
+  systemMetadata() azure.subscription.systemData
 }
 
 // Azure AI Search
@@ -11652,6 +11682,8 @@ azure.subscription.appConfigurationService.configurationStore @defaults("id name
   defaultKeyValueRevisionRetentionPeriodInSeconds int
   // When the configuration store was created
   creationTime time
+  // Private endpoint connections to the configuration store
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Creation and last-modification provenance recorded by Azure Resource Manager
   systemMetadata() azure.subscription.systemData
 }
@@ -11741,6 +11773,8 @@ azure.subscription.cognitiveServicesService.account @defaults("id name location
   projects() []azure.subscription.cognitiveServicesService.account.project
   // Account-scoped connections to external resources, model providers, data sources, and tool servers
   connections() []azure.subscription.cognitiveServicesService.account.connection
+  // Private endpoint connections to the account
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Creation and last-modification provenance recorded by Azure Resource Manager
   systemMetadata() azure.subscription.systemData
 }
@@ -12163,6 +12197,8 @@ azure.subscription.signalRService.signalR @defaults("id name location publicNetw
   networkAclsDefaultAction string
   // Provisioning state
   provisioningState string
+  // Private endpoint connections to the instance
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Creation and last-modification provenance recorded by Azure Resource Manager
   systemMetadata() azure.subscription.systemData
 }
@@ -12222,6 +12258,8 @@ azure.subscription.webPubSubService.webPubSub @defaults("id name location public
   networkAclsDefaultAction string
   // Provisioning state
   provisioningState string
+  // Private endpoint connections to the instance
+  privateEndpointConnections() []azure.subscription.privateEndpointConnection
   // Creation and last-modification provenance recorded by Azure Resource Manager
   systemMetadata() azure.subscription.systemData
 }