azure-arm-deployment-write-script-inline
Principal with deployments/write at any scope can submit a deployment template containing an inline deploymentScript with attacker-controlled scriptContent.
match (effective permission)
{
"action": "Microsoft.Resources/deployments/write",
"scope_type": "resource|resourceGroup|subscription|managementGroup"
}
where
the submitted ARM template includes a Microsoft.Resources/deploymentScripts resource with attacker-controlled scriptContent or primaryScriptUri
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <ARM deployment (BuildWorker)> |
| permissions | Microsoft.Resources/deployments/write |
| conditions | role_compatibility service_state |
| state logic | ACTIVE when the principal holds deployments/write at the scope AND the submitted template includes a deploymentScript block with attacker- controlled scriptContent AND assign/action on the referenced UAMI is confirmed (ARM engine requires both). CONDITIONAL(role_compatibility) if assign/action on the UAMI is not confirmed. CONDITIONAL(service_state) if the Microsoft.ContainerInstance provider is not registered. BLOCKED if a deny assignment covers deployments/write. |
Narrative
{principal.name} can submit an ARM deployment at {target.name}'s scope (Microsoft.Resources/deployments/write) carrying an inline deploymentScript resource with attacker-controlled PowerShell or Bash in its scriptContent; the ACI container executes that code as the script's attached UAMI. cicd-chains (cicd-modify-buildspec-executes-as) collapses this CanModifyCode on the deployment + its ExecutesAs(UAMI) into CanExecuteAs(UAMI).
Raw rule rules/derived/azure/arm-deployments.yaml
id: azure-arm-deployment-write-script-inline
emits: CanModifyCode
description: Principal with deployments/write at any scope can submit a deployment template containing
an inline deploymentScript with attacker-controlled scriptContent.
match_effective_permission:
action: Microsoft.Resources/deployments/write
scope_type: resource|resourceGroup|subscription|managementGroup
where:
- the submitted ARM template includes a Microsoft.Resources/deploymentScripts resource with attacker-controlled
scriptContent or primaryScriptUri
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <ARM deployment (BuildWorker)>
permissions:
- Microsoft.Resources/deployments/write
conditions:
- role_compatibility
- service_state
state_logic: ACTIVE when the principal holds deployments/write at the scope AND the submitted template
includes a deploymentScript block with attacker- controlled scriptContent AND assign/action on the
referenced UAMI is confirmed (ARM engine requires both). CONDITIONAL(role_compatibility) if assign/action
on the UAMI is not confirmed. CONDITIONAL(service_state) if the Microsoft.ContainerInstance provider
is not registered. BLOCKED if a deny assignment covers deployments/write.
false_positive_note: "The submitted template MUST include a Microsoft.Resources/deploymentScripts resource\
\ block for this edge to emit \u2014 a plain deployment/write without an inline script is mere CanTrigger\
\ (see azure-arm-deployment-write-trigger). The deploying principal must also hold assign/action on\
\ the UAMI named in the deploymentScript's identity block; without it the ARM engine rejects the deployment.\
\ secureString parameters in the template are redacted in deployment history; do NOT emit CanReadSecret\
\ for them. The ACI container is ephemeral: execution capability persists only for the script's run."
narrative: '{principal.name} can submit an ARM deployment at {target.name}''s scope (Microsoft.Resources/deployments/write)
carrying an inline deploymentScript resource with attacker-controlled PowerShell or Bash in its scriptContent;
the ACI container executes that code as the script''s attached UAMI. cicd-chains (cicd-modify-buildspec-executes-as)
collapses this CanModifyCode on the deployment + its ExecutesAs(UAMI) into CanExecuteAs(UAMI).'
derived_from:
- <deployments/write effective permission>
- 'cicd-chains: cicd-modify-buildspec-executes-as (roll-up)'