rage.fail

azure-aci-execute-as-via-redeploy

write (recreate) a container group that already runs as an MI => execute as that MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyCode {'group': None} {'group': None} ExecutesAs {'mi': None}

where

node_type(?group) == ContainerService ?mi.privilege_level >= ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.ContainerInstance/containerGroups/write`

Narrative

{principal.name} can recreate {group.name} with an attacker image (containerGroups/write), running code as its identity {mi.name}.

Raw rule rules/derived/azure/aci.yaml

id: azure-aci-execute-as-via-redeploy
emits: CanExecuteAs
description: write (recreate) a container group that already runs as an MI => execute as that MI.
match:
- - principal: null
  - CanModifyCode
  - group: null
- - group: null
  - ExecutesAs
  - mi: null
where:
- node_type(?group) == ContainerService
- ?mi.privilege_level >= ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  permissions:
  - Microsoft.ContainerInstance/containerGroups/write
  derived_from:
  - <CanModifyCode edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: Recreating the group preserves its identity binding by default; emit only when
    the group has an MI that out-privileges the caller.
  narrative: '{principal.name} can recreate {group.name} with an attacker image (containerGroups/write),
    running code as its identity {mi.name}.'