Resource Trusts

resource-trusts

resource-trusts is the cross-resource trust-boundary command for public-versus-private posture across supported services.

Use it when the interesting question is broader than one service and becomes "where are the most permissive trust boundaries across the estate?"

What This Command Answers

• Which supported resources still trust broader public or mixed paths?
• Which resource boundary looks more permissive or surprising than expected?
• Which trust posture should change what you inspect next?

Run It

azurefox resource-trusts --output table

For saved structured output:

azurefox resource-trusts --output json

Example Table Output

resource	type	trust	target	exposure
kvlabopen01	KeyVault	public-network	public-network	high
stlabpub01	StorageAccount	anonymous-blob-access	public-network	high
kvlabdeny01	KeyVault	public-network	public-network	medium

When To Use It

• when you need to compare trust posture across more than one resource family
• when public-versus-private posture matters more than raw inventory counts
• when you want a routing view before dropping into a service-specific command

What To Look For

• publicly trusting resources before private-only paths
• mixed posture that looks more permissive than expected
• trust target and resource-family context that makes the next service command obvious
• supported services whose trust boundary changes priority immediately

Why It Matters

Public-versus-private trust posture often changes priority more than raw counts do.

A resource that still trusts broader public paths may deserve attention before a larger number of quieter private-only assets. resource-trusts helps you compare those boundaries directly instead of discovering them one service table at a time.

What Should Stand Out First

• public trust before private-only posture
• mixed or surprising trust patterns
• supported resource families that stay more permissive than expected
• enough context to choose the next service command quickly

If You See..., Go Next To...

• If you see a storage account trust_type=anonymous-blob-access, go next to Storage because it shows the exact network and auth posture behind that storage finding.
• If you see a Key Vault trust_type=public-network, go next to Keyvault because it shows the vault-specific network and recovery posture behind that trust signal.

What To Do Next

• Treat resource-trusts as a narrowing command, not the end of the investigation.
• Use it to choose the exact resource family whose trust posture deserves service-specific review next.
• Prioritize the resources whose trust story is broader, more public, or more surprising than the rest.

Boundary

resource-trusts is a routing and comparison command.

It should compare trust boundaries across supported services. It is not exhaustive coverage for all Azure resource types or a replacement for deeper service-specific output.