rage.fail

azure-aci-start

derived azure emits CanStart

match (effective permission)

{ "action": "Microsoft.ContainerInstance/containerGroups/start/action", "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<containerGroup>`
permissions	`Microsoft.ContainerInstance/containerGroups/start/action`

Narrative

{principal.name} can start stopped container group {target.name} (start/action or restart/action) to enable execution.

Raw rule rules/derived/azure/aci.yaml

id: azure-aci-start
emits: CanStart
match_effective_permission:
  action: Microsoft.ContainerInstance/containerGroups/start/action
  scope_type: resource|resourceGroup|subscription
optional_permission: Microsoft.ContainerInstance/containerGroups/restart/action
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <containerGroup>
  permissions:
  - Microsoft.ContainerInstance/containerGroups/start/action
  permissions_note: When the capability is realized via restart instead of start, record Microsoft.ContainerInstance/containerGroups/restart/action
    in permissions[] (in place of or in addition to start/action) so the edge evidence reflects the action
    actually held.
  note: Realizes CONDITIONAL(service_state) execution edges on stopped groups. restart/action is equivalent
    for re-running the entrypoint; whichever action the principal actually holds MUST be the one recorded
    in permissions[].
  narrative: '{principal.name} can start stopped container group {target.name} (start/action or restart/action)
    to enable execution.'