rage.fail

azure-appsvc-config-write

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": [ "Microsoft.Web/sites/config/write", "Microsoft.Web/sites/config/web/appsettings/write" ], "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<Microsoft.Web/sites>`
permissions	`Microsoft.Web/sites/config/write` `Microsoft.Web/sites/config/web/appsettings/write`
conditions	`service_state`

Narrative

{principal.name} can rewrite the configuration of {target.name} (config/write) including the startup command and app settings.

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-config-write
emits: CanModifyConfiguration
match_effective_permission:
  action:
  - Microsoft.Web/sites/config/write
  - Microsoft.Web/sites/config/web/appsettings/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Microsoft.Web/sites>
  permissions:
  - Microsoft.Web/sites/config/write
  - Microsoft.Web/sites/config/web/appsettings/write
  conditions:
  - service_state
  note: Set appCommandLine (Linux startup command), WEBSITE_RUN_FROM_PACKAGE, handler mappings, or the
    identity block; realizes execution at next restart/boot.
  false_positive_note: Config-driven execution needs a restart and a running plan; on a stopped app CONDITIONAL(service_state)
    + CanStart.
  narrative: '{principal.name} can rewrite the configuration of {target.name} (config/write) including
    the startup command and app settings.'