azure-arm-deployment-role-assignment

id: azure-arm-deployment-role-assignment
emits: CanGrantPermission
description: A deployment at subscription/MG scope whose deploying principal already holds roleAssignments/write
  can create role assignments (including Owner) for any identity via the template.
match_effective_permission:
  action: Microsoft.Authorization/roleAssignments/write
  scope_type: subscription|managementGroup
where:
- principal also holds Microsoft.Resources/deployments/write at the same or broader scope
- the deployment scope is at subscription or management-group level (broad blast radius)
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <any identity grantable a role at the subscription/MG scope>
  permissions:
  - Microsoft.Authorization/roleAssignments/write
  - Microsoft.Resources/deployments/write
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the principal holds BOTH roleAssignments/write AND deployments/write at the
    target scope and no deny assignment blocks either action.  CONDITIONAL(scp_or_org_policy) if a management-group
    policy (e.g. Azure Policy deny effect) blocks roleAssignments/write.  BLOCKED if a deny assignment
    covers Microsoft.Authorization/roleAssignments/write. Inherits weakest with contributing edges.
  false_positive_note: "CITE identity-escalation.yaml azure-role-assignment-write as the baseline \u2014\
    \ if the principal already directly holds Owner/User Access Administrator, that rule already emits\
    \ CanGrantPermission; this rule adds the DEPLOYMENT- MEDIATED framing (the template as the vehicle).\
    \  The ARM engine does NOT elevate beyond the calling principal's RBAC; a template referencing roleAssignments/write\
    \ submitted by a Contributor (who lacks that action) fails at the ARM engine level \u2014 do NOT emit\
    \ unless roleAssignments/write is CONFIRMED effective on the principal.  Dedupes with azure-role-assignment-write\
    \ on (CanGrantPermission, ?principal, any); emit once. The target is WILDCARD (any identity that can\
    \ receive a role at this scope); the scope boundary itself is the implicit objective.  can-control.yaml\
    \ control-boundary-via-iam-admin collapses CanGrantPermission at a boundary scope into Controls(boundary)\
    \ \u2014 cite, do not re-derive."
  narrative: "{principal.name} holds Microsoft.Authorization/roleAssignments/write at the subscription/management-group\
    \ scope and can include a roleAssignment resource in an ARM deployment to grant any identity (including\
    \ itself) any role at that scope \u2014 effective ownership of all resources in that boundary."
  derived_from:
  - 'identity-escalation.yaml: azure-role-assignment-write (direct CanGrantPermission)'
  - <deployments/write effective permission at scope>
  - "can-control.yaml: control-boundary-via-iam-admin (CanGrantPermission at boundary => Controls \u2014\
    \ cited)"