rage.fail

azure-appsvc-attach-user-mi

derived azure emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'userMI': None}

where

?principal has EFFECTIVE Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on ?userMI ?principal has EFFECTIVE Microsoft.Web/sites/write on the target site the target site is an EXISTING Microsoft.Web/sites resource

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<Microsoft.Web/sites (existing)>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Web/sites/write`
conditions	`role_compatibility`

Narrative

{principal.name} can attach user-assigned MI {userMI.name} to existing App Service {target.name} (assign/action + sites/write).

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-attach-user-mi
emits: CanAttachIdentity
match:
- - principal: null
  - CanPassIdentity
  - userMI: null
where:
- ?principal has EFFECTIVE Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on ?userMI
- ?principal has EFFECTIVE Microsoft.Web/sites/write on the target site
- the target site is an EXISTING Microsoft.Web/sites resource
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <Microsoft.Web/sites (existing)>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Web/sites/write
  conditions:
  - role_compatibility
  false_positive_note: 'BOTH permissions are required: assign/action on the MI AND sites/write on the
    site. Neither alone attaches the MI. Honor the assign/action resource scope. CanAttachIdentity applies
    only to an EXISTING site; the create-new-site variant is modeled via CanDeploy + CanPassIdentity ->
    CanCreateWorkloadAs, not this rule.'
  narrative: '{principal.name} can attach user-assigned MI {userMI.name} to existing App Service {target.name}
    (assign/action + sites/write).'