Summary

Converts 23 eagerly-loaded sub-resource fields across 6 Azure resource types to lazy-loaded computed methods. This means sub-resource data is only fetched when a query actually references it, instead of being materialized on every scan.

What changed

Network resources (network.go):

• Load Balancer — 7 fields lazy-loaded: probes, backendPools, frontendIpConfigs, inboundNatPools, inboundNatRules, outboundRules, loadBalancerRules. Previously every LB list call parsed all 7 sub-resource arrays upfront. Now the list call returns just the LB metadata; sub-resources are only materialized from the cached Properties when accessed.
• Firewall — 5 fields: ipConfigurations, managementIpConfiguration, networkRules, natRules, applicationRules.
• Security Group — 3 fields: interfaces, securityRules, defaultSecurityRules.
• Virtual Network Gateway — 3 fields: ipConfigurations, bgpSettings, natRules.

AKS (aks.go):

• AKS Cluster — 2 fields: aadProfile, autoUpgradeProfile. These were parsed from the cluster Properties on every list even though most queries don't inspect them.

IAM (iam.go):

• Role Definition — 1 field: permissions. The permissions array is now lazy-loaded from the cached role definition properties.

Redis (redis.go):

• Redis Instance — 1 field: privateEndpointConnections. Parsed on demand instead of during the list call.

API call savings

Azure List APIs return the full resource object including all sub-resource arrays in the Properties blob. Before this PR, we were parsing all of those into MQL resources during the list call — meaning every sub-resource got CreateResource called even if no query ever touched it.

After this PR, the raw Properties struct is cached on the Internal struct, and sub-resources are only materialized when a query accesses the field. This eliminates thousands of unnecessary CreateResource + convert.JsonToDict calls during scan initialization.

Example: A subscription with 20 Load Balancers, each with ~5 probes, 3 backend pools, 4 frontend IPs, 2 NAT rules, 2 outbound rules, and 3 LB rules:

• Before: 20 × (5+3+4+2+2+3) = 380 CreateResource calls at scan start, even if the query is just azure.subscription.networkService.loadBalancers { name }
• After: 20 CreateResource calls at scan start. Sub-resources only created if the query traverses into them.

Also fixed

• Typo: outbundRule → outboundRule (resource name was misspelled)
• Added nil-safety guards on Properties access throughout network.go

Test plan

• make test/lint passes
• make providers/build/azure && make providers/install/azure
• Interactive verification with mql shell azure:
  • azure.subscription.networkService.loadBalancers { name probes backendPools }
  • azure.subscription.networkService.firewalls { name ipConfigurations networkRules }
  • azure.subscription.networkService.securityGroups { name securityRules defaultSecurityRules }
  • azure.subscription.aksService.clusters { name aadProfile autoUpgradeProfile }
  • azure.subscription.authorizationService.roleDefinitions { name permissions }
  • azure.subscription.cacheService.redisInstances { hostName privateEndpointConnections }

🤖 Generated with Claude Code