azure-assign-user-assigned-mi
match (effective permission)
{
"action": "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action"
}
where
principal also has write on a compute resource that can bind the MI
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/assign/action <resource>/write |
Narrative
{principal.name} can assign user-assigned MI {mi.name} to a resource it controls and execute as it.
Raw rule rules/derived/azure/identity-escalation.yaml
id: azure-assign-user-assigned-mi
emits: CanPassIdentity
match_effective_permission:
action: Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
where:
- principal also has write on a compute resource that can bind the MI
emit:
source_type: Identity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
- <resource>/write
note: Pairs with compute write -> CanExecuteAs(MI) (Phase 4).
narrative: '{principal.name} can assign user-assigned MI {mi.name} to a resource it controls and execute
as it.'