azure-aci-exec

id: azure-aci-exec
emits: CanExecuteCommand
match_effective_permission:
  action: Microsoft.ContainerInstance/containerGroups/containers/exec/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  source: <principal>
  target: <container within the container group>
  permissions:
  - Microsoft.ContainerInstance/containerGroups/containers/exec/action
  conditions:
  - service_state
  state_logic: ACTIVE if the container group is running; else CONDITIONAL(service_state) and pair with
    azure-aci-start
  false_positive_note: "exec only attaches to a running container; on a stopped/terminated group emit\
    \ CONDITIONAL(service_state). No OS credential is required \u2014 this is a control-plane action.\
    \ Target is the Container node (generic_type Container, an allowed CanExecuteCommand target), NOT\
    \ the ContainerService group; the group\u2192MI ExecutesAs fact is carried on the group and joined\
    \ via Contains in azure-aci-execute-as-via-exec."
  narrative: '{principal.name} can open an interactive shell in a container of {target.name} (containers/exec/action)
    with no OS credential.'