azure-acr-task-pass-identity
Assigning a user-assigned MI to an ACR Task requires both tasks/write AND MI assign/action.
match (effective permission)
{
"action": "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role including Microsoft.
ManagedIdentity/userAssignedIdentities/assign/action
target is a user-assigned managed identity (ManagedIdentity node)
emit
| source type | Identity |
|---|---|
| target type | ManagedIdentity |
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/assign/action |
| state logic | ACTIVE when the principal can assign the UAMI. This edge combines with CanModifyConfiguration on an ACR Task via can-execute-as execute-as-via-config-identity-swap to produce CanExecuteAs when the principal can both swap the task's MI AND modify its config. |
Narrative
{principal.name} can assign {target.name} (user-assigned managed identity) to a resource, enabling identity swapping on any task that supports MI binding when combined with CanModifyConfiguration on that task.
Raw rule rules/derived/azure/acr.yaml
id: azure-acr-task-pass-identity
emits: CanPassIdentity
description: Assigning a user-assigned MI to an ACR Task requires both tasks/write AND MI assign/action.
match_effective_permission:
action: Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role including Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
- target is a user-assigned managed identity (ManagedIdentity node)
emit:
source_type: Identity
target_type: ManagedIdentity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
state_logic: ACTIVE when the principal can assign the UAMI. This edge combines with CanModifyConfiguration
on an ACR Task via can-execute-as execute-as-via-config-identity-swap to produce CanExecuteAs when
the principal can both swap the task's MI AND modify its config.
confidence: 0.92
derived_from: []
false_positive_note: CanPassIdentity targets the MI resource, not the task. The escalation consequence
is produced by execute-as-via-config-identity-swap (CanModifyConfiguration + CanPassIdentity + role_compatible
=> CanExecuteAs) when both the task write and MI assignment actions are held. Do not double-emit CanExecuteAs
here.
narrative: '{principal.name} can assign {target.name} (user-assigned managed identity) to a resource,
enabling identity swapping on any task that supports MI binding when combined with CanModifyConfiguration
on that task.'