Azure Modeling Notes#

Azure Container Instances#

AzureGroupContainer represents an Azure Container Instances container group, which is a co-scheduled group of one or more containers. It carries the ComputePod ontology label because its semantics are closer to an ECS task or Kubernetes pod than to an individual container.

Each container in the group is represented separately as an AzureContainerInstance with the Container ontology label. Azure Container Instances does not expose host architecture, so Cartography records amd64. Image relationships are created only for digest-pinned references such as image@sha256:...; tag-only references do not produce HAS_IMAGE.

Load Balancer Exposure#

Analysis jobs connect internet-facing Azure load balancers to private virtual machines through EXPOSE. Azure Firewall protection is inferred through virtual network topology. This is an approximation and does not validate the effective route path or evaluate firewall rules.

Application Gateway Routing#

Application Gateway uses a parent gateway with frontend IP, backend pool, and routing rule sub-resources. Listener and backend HTTP settings are folded onto each AzureApplicationGatewayRule.

For basic rules, the routing rule connects its frontend IP to a backend pool. Path-based rules expose url_path_map_id, but Cartography does not create a single ROUTES_TO edge or populate folded backend properties because individual path rules can target different backend pools.

Backend pools can route to Azure network interfaces, public IP addresses, and nodes carrying the cross-provider DNSRecord ontology label.

Azure Tags#

Azure resources with the same subscription, key, and value share one AzureTag node. Azure tags also carry the cross-provider Tag ontology label for queries across Azure, AWS, GCP, Tenable, and other providers.