azure-arm-deploymentscript-write
Create or update a deploymentScript resource to run arbitrary PS/Bash as its attached UAMI.
match (effective permission)
{
"action": "Microsoft.Resources/deploymentScripts/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Microsoft.Resources/deploymentScripts/write at the scope
the deploymentScript resource has an identity block naming a user-assigned MI (UAMI)
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <deploymentScript resource (BuildWorker / ContainerTask)> |
| permissions | Microsoft.Resources/deploymentScripts/write |
| conditions | role_compatibility service_state |
| state logic | ACTIVE when the principal holds deploymentScripts/write AND assign/action on the referenced UAMI (both are required for the deployment to succeed). CONDITIONAL(role_compatibility) when assign/action on the UAMI is not confirmed (the deployment would fail without it). CONDITIONAL(service_state) if the Microsoft.ContainerInstance provider is not registered in the subscription (deploymentScripts require ACI). BLOCKED if a deny assignment covers deploymentScripts/write at this scope. |
Narrative
{principal.name} can create or update deploymentScript {target.name} (Microsoft.Resources/deploymentScripts/write), injecting arbitrary PowerShell or Bash into its scriptContent; the ACI container executes that code as the script's attached UAMI. cicd-chains (cicd-modify-buildspec-executes-as) collapses this with the script's ExecutesAs edge into CanExecuteAs(UAMI).
Raw rule rules/derived/azure/arm-deployments.yaml
id: azure-arm-deploymentscript-write
emits: CanModifyCode
description: Create or update a deploymentScript resource to run arbitrary PS/Bash as its attached UAMI.
match_effective_permission:
action: Microsoft.Resources/deploymentScripts/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Microsoft.Resources/deploymentScripts/write at the scope
- the deploymentScript resource has an identity block naming a user-assigned MI (UAMI)
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <deploymentScript resource (BuildWorker / ContainerTask)>
permissions:
- Microsoft.Resources/deploymentScripts/write
conditions:
- role_compatibility
- service_state
state_logic: ACTIVE when the principal holds deploymentScripts/write AND assign/action on the referenced
UAMI (both are required for the deployment to succeed). CONDITIONAL(role_compatibility) when assign/action
on the UAMI is not confirmed (the deployment would fail without it). CONDITIONAL(service_state) if
the Microsoft.ContainerInstance provider is not registered in the subscription (deploymentScripts
require ACI). BLOCKED if a deny assignment covers deploymentScripts/write at this scope.
false_positive_note: "deploymentScripts/write alone is NOT sufficient \u2014 the deploying principal\
\ must ALSO hold Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on the UAMI named\
\ in the script's identity block; without it the ARM engine rejects the deployment. Do NOT emit ACTIVE\
\ unless assign/action is confirmed. A deploymentScript with no identity block runs as no identity\
\ and yields no CanExecuteAs \u2014 do not emit CanModifyCode in that case (nothing to execute as).\
\ The ACI container is ephemeral: execution capability persists only for the script's run; there is\
\ no standing compute to re-enter."
narrative: '{principal.name} can create or update deploymentScript {target.name} (Microsoft.Resources/deploymentScripts/write),
injecting arbitrary PowerShell or Bash into its scriptContent; the ACI container executes that code
as the script''s attached UAMI. cicd-chains (cicd-modify-buildspec-executes-as) collapses this with
the script''s ExecutesAs edge into CanExecuteAs(UAMI).'
derived_from:
- azure-arm-deploymentscript-write (match_effective_permission)
- 'cicd-chains: cicd-modify-buildspec-executes-as (roll-up)'