Back to Checks
azure

Subscription has an Activity Log Alert for Public IP address create or update operations

monitor_alert_create_update_public_ip_address_rule
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:microsoft.insights/activitylogalerts

Azure Monitor activity log alert for Public IP addresses tracks Microsoft.Network/publicIPAddresses/write events at the subscription level, covering any creation or update of public IP resources.

Prowler logoProwlerprowler-provider-azure

Risk

Without this alert, unauthorized or mistaken public IP changes can go unnoticed, exposing workloads to the Internet.

  • Confidentiality: unexpected ingress paths
  • Integrity: shadow endpoints for control
  • Availability: larger DDoS surface and outages

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_create_update_public_ip_address_rule

Recommendation

Create a subscription-wide activity log alert on Microsoft.Network/publicIPAddresses/write and route it to an action group.

Enforce least privilege for IP management, apply change control, and use defense in depth (private endpoints, bastions, VPN) to minimize public exposure and speed response.

Remediation

CLI

az monitor activity-log alert create --resource-group <example_resource_name> --name <example_resource_name> --scopes /subscriptions/<example_resource_id> --condition "category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write" --location global

Terraform

# Activity Log Alert for Public IP create/update
resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  scopes              = ["/subscriptions/<example_resource_id>"]

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Network/publicIPAddresses/write" # Critical: alerts on Public IP create/update
  }
}

NativeIaC

// Activity Log Alert for Public IP create/update
resource alert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'global'
  properties: {
    enabled: true
    scopes: ['/subscriptions/<example_resource_id>']
    condition: {
      allOf: [
        { field: 'category', equals: 'Administrative' }
        { field: 'operationName', equals: 'Microsoft.Network/publicIPAddresses/write' } // Critical: alerts on Public IP create/update
      ]
    }
  }
}

Other

1In Azure Portal, go to Monitor > Alerts > Alert rules > Create
2Scope: Select your subscription and click Done
3Condition: Choose Activity log, then select the signal "Create or Update Public Ip Address (publicIPAddresses)"
4Details: Enter an alert rule name; Region: Global; Ensure Enable alert rule upon creation is checked
5Click Review + create, then Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_create_update_public_ip_address_rule(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                if check_alert_rule(
                    alert_rule, "Microsoft.Network/publicIPAddresses/write"
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=alert_rule
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"There is an alert configured for creating/updating Public IP address rule in subscription {subscription_name} ({subscription_id})."
                    break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References