azure-acr-scope-map-write
scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading restricted tokens to include push/write capability.
match (effective permission)
{
"action": "Microsoft.ContainerRegistry/registries/scopeMaps/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role including Microsoft.
ContainerRegistry/registries/scopeMaps/write
emit
| source type | Identity |
|---|---|
| target type | ResourcePolicy |
| source | <principal> |
| target | <scope map (ResourcePolicy)> |
| permissions | Microsoft.ContainerRegistry/registries/scopeMaps/write |
| state logic | ACTIVE when the principal can modify a scope map and no deny assignment blocks the action. BLOCKED when a deny assignment at this scope covers Microsoft.ContainerRegistry/registries/scopeMaps/write (denied_by=<deny assignment id>). |
Narrative
{principal.name} can modify the scope map {target.name} (Microsoft.ContainerRegistry/registries/scopeMaps/write); by adding push/write actions or repository scopes to a scope map that restricts a token, the token's capabilities are expanded - potentially converting a pull-only token into a supply-chain credential (container-chains propagates the CanModifyCode upgrade).
Raw rule rules/derived/azure/acr.yaml
id: azure-acr-scope-map-write
emits: CanModifyPolicy
description: scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading
restricted tokens to include push/write capability.
match_effective_permission:
action: Microsoft.ContainerRegistry/registries/scopeMaps/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role including Microsoft.ContainerRegistry/registries/scopeMaps/write
emit:
source_type: Identity
target_type: ResourcePolicy
source: <principal>
target: <scope map (ResourcePolicy)>
permissions:
- Microsoft.ContainerRegistry/registries/scopeMaps/write
state_logic: ACTIVE when the principal can modify a scope map and no deny assignment blocks the action.
BLOCKED when a deny assignment at this scope covers Microsoft.ContainerRegistry/registries/scopeMaps/write
(denied_by=<deny assignment id>).
confidence: 0.9
derived_from: []
false_positive_note: Modifying a scope map changes the actions and repositories a bound token can access.
A principal who modifies a scope map attached to a pull-only token can add push/write actions, converting
that token into a supply-chain primitive. This edge models the policy-mutation capability. The escalation
consequence (token upgraded to push-capable then used for CanModifyCode) is rolled up by container-chains
and credential-chains, which consume this CanModifyPolicy. Scope maps are ResourcePolicy nodes (not
ServiceControlPolicy / OrganizationPolicy guardrails), so this is a direct policy write, not a guardrail
removal.
narrative: "{principal.name} can modify the scope map {target.name} (Microsoft.ContainerRegistry/registries/scopeMaps/write);\
\ by adding push/write actions or repository scopes to a scope map that restricts a token, the token's\
\ capabilities are expanded \u2014 potentially converting a pull-only token into a supply-chain credential\
\ (container-chains propagates the CanModifyCode upgrade)."