azure-acr-contributor
Full control of the registry (write + all sub-resource management).
match (effective permission)
{
"action": "Microsoft.ContainerRegistry/registries/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role that includes Microsoft.
ContainerRegistry/registries/* at the scope
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <registry> |
| permissions | Microsoft.ContainerRegistry/registries/write Microsoft.ContainerRegistry/registries/delete Microsoft.ContainerRegistry/registries/listCredentials/action Microsoft.ContainerRegistry/registries/tokens/write Microsoft.ContainerRegistry/registries/tasks/write Microsoft.ContainerRegistry/registries/webhooks/write |
| state logic | ACTIVE when the principal has the effective permission and no deny assignments block write/delete actions. BLOCKED when a deny assignment covers Microsoft.ContainerRegistry/registries/write or registries/delete at this scope (denied_by=<deny assignment id>). |
Narrative
{principal.name} has full administrative control of registry {target.name} (Microsoft.ContainerRegistry/registries/*) including the ability to push images, manage tasks, enable the admin account, and modify network/trust policy.
Raw rule rules/derived/azure/acr.yaml
id: azure-acr-contributor
emits: CanAdminister
description: Full control of the registry (write + all sub-resource management).
match_effective_permission:
action: Microsoft.ContainerRegistry/registries/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role that includes Microsoft.ContainerRegistry/registries/*
at the scope
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <registry>
permissions:
- Microsoft.ContainerRegistry/registries/write
- Microsoft.ContainerRegistry/registries/delete
- Microsoft.ContainerRegistry/registries/listCredentials/action
- Microsoft.ContainerRegistry/registries/tokens/write
- Microsoft.ContainerRegistry/registries/tasks/write
- Microsoft.ContainerRegistry/registries/webhooks/write
state_logic: ACTIVE when the principal has the effective permission and no deny assignments block write/delete
actions. BLOCKED when a deny assignment covers Microsoft.ContainerRegistry/registries/write or registries/delete
at this scope (denied_by=<deny assignment id>).
confidence: 0.97
false_positive_note: "AcrPush role does NOT grant CanAdminister \u2014 it only includes push/write and\
\ pull/read plus listCredentials/action (which is sufficient for ExposesCredential but not full admin).\
\ Only Contributor / Owner / custom wildcard (* on registries) qualifies. Deny assignments over write\
\ yield BLOCKED. When CanAdminister is ACTIVE, the CanModifyConfiguration edge (azure-acr-registry-write-config)\
\ is subsumed to prevent double-counting."
narrative: '{principal.name} has full administrative control of registry {target.name} (Microsoft.ContainerRegistry/registries/*)
including the ability to push images, manage tasks, enable the admin account, and modify network/trust
policy.'