rage.fail

azure-aks-cluster-executes-as-control-plane-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "identity", "resource_type": "Microsoft.ContainerService/managedClusters" }

where

identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned']

emit

source type	`KubernetesCluster`
target type	`ManagedIdentity`
source	`<managedCluster>`
target	`<system-assigned SP (principalId) or each userAssignedIdentities key>`

Narrative

AKS cluster {cluster.name} runs its control plane as managed identity {mi.name}.

Raw rule rules/explicit/azure-aks.yaml

id: azure-aks-cluster-executes-as-control-plane-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Microsoft.ContainerService/managedClusters
  field: identity
where:
- identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned']
emit:
  source_type: KubernetesCluster
  target_type: ManagedIdentity
  source: <managedCluster>
  target: <system-assigned SP (principalId) or each userAssignedIdentities key>
  api_source: az aks show --name <name> --resource-group <rg>
  evidence_field: identity.principalId | identity.userAssignedIdentities
  narrative: AKS cluster {cluster.name} runs its control plane as managed identity {mi.name}.