azure-appgw-admin
Holding Microsoft.Network/applicationGateways/* grants full control of an Application Gateway including routing rules, SSL certs, WAF policy, and backend pools.
match (effective permission)
{
"action": "Microsoft.Network/applicationGateways/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Microsoft.Network/applicationGateways/* (Network Contributor / Contributor / Owner)
emit
| source type | Identity |
|---|---|
| target type | LoadBalancer |
| source | <principal> |
| target | <Microsoft.Network/applicationGateways in scope> |
| permissions | Microsoft.Network/applicationGateways/write Microsoft.Network/applicationGateways/delete Microsoft.Network/applicationGateways/start/action Microsoft.Network/applicationGateways/stop/action Microsoft.Network/applicationGateways/backendAddressPools/write Microsoft.Network/applicationGateways/backendHttpSettingsCollection/write Microsoft.Network/applicationGateways/urlPathMaps/write Microsoft.Network/applicationGateways/requestRoutingRules/write |
Narrative
{principal.name} has full administrative control of Application Gateway {target.name} (Microsoft.Network/applicationGateways/*), including routing rules, backend pools, SSL certificates, backend HTTP settings, URL path maps, request routing rules, WAF policy, and the ability to start or stop the gateway.
Raw rule rules/derived/azure/loadbalancer.yaml
id: azure-appgw-admin
emits: CanAdminister
description: Holding Microsoft.Network/applicationGateways/* grants full control of an Application Gateway
including routing rules, SSL certs, WAF policy, and backend pools.
match_effective_permission:
action: Microsoft.Network/applicationGateways/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Microsoft.Network/applicationGateways/* (Network Contributor / Contributor
/ Owner)
emit:
source_type: Identity
target_type: LoadBalancer
source: <principal>
target: <Microsoft.Network/applicationGateways in scope>
permissions:
- Microsoft.Network/applicationGateways/write
- Microsoft.Network/applicationGateways/delete
- Microsoft.Network/applicationGateways/start/action
- Microsoft.Network/applicationGateways/stop/action
- Microsoft.Network/applicationGateways/backendAddressPools/write
- Microsoft.Network/applicationGateways/backendHttpSettingsCollection/write
- Microsoft.Network/applicationGateways/urlPathMaps/write
- Microsoft.Network/applicationGateways/requestRoutingRules/write
false_positive_note: CanAdminister requires the write wildcard. Network Contributor qualifies. The wildcard
does NOT include Microsoft.Authorization/*/write. App GW/write does NOT automatically grant rights
over the Key Vault holding SSL certificates; that requires separate permissions on the Key Vault.
The permissions list includes sub-resource write operations that are independently grantable and covered
by the wildcard (Network Contributor / Contributor / Owner).
narrative: '{principal.name} has full administrative control of Application Gateway {target.name} (Microsoft.Network/applicationGateways/*),
including routing rules, backend pools, SSL certificates, backend HTTP settings, URL path maps, request
routing rules, WAF policy, and the ability to start or stop the gateway.'