rage.fail

azure-aci-deploy

derived azure emits CanDeploy

match (effective permission)

{ "action": "Microsoft.ContainerInstance/containerGroups/write", "scope_type": "resourceGroup|subscription" }

emit

source type	`Identity`
source	`<principal>`
target	`<containerGroup (new) in scope>`
permissions	`Microsoft.ContainerInstance/containerGroups/write`

Narrative

{principal.name} can deploy a new container group in {scope} (containerGroups/write).

Raw rule rules/derived/azure/aci.yaml

id: azure-aci-deploy
emits: CanDeploy
match_effective_permission:
  action: Microsoft.ContainerInstance/containerGroups/write
  scope_type: resourceGroup|subscription
emit:
  source_type: Identity
  source: <principal>
  target: <containerGroup (new) in scope>
  permissions:
  - Microsoft.ContainerInstance/containerGroups/write
  note: Create a brand-new container group running an attacker image; combine with assign/action to attach
    a privileged MI (azure-aci-attach-user-mi).
  narrative: '{principal.name} can deploy a new container group in {scope} (containerGroups/write).'