azure-auto-account-contributor
Full control of an Automation Account (Automation Contributor / Contributor / Owner).
match (effective permission)
{
"action": "Microsoft.Automation/automationAccounts/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Automation Contributor, Contributor, Owner, or a custom role granting Microsoft.Automation/automationAccounts/* at the scope
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <automationAccount in scope> |
| permissions | Microsoft.Automation/automationAccounts/write |
| state logic | ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers automationAccounts/write at the scope. CanAdminister(account) does NOT imply CanGrantPermission — escalation is via the account's managed identity (or RunAs SP), not via self role-assignment or Microsoft.Authorization/*/write. |
Narrative
{principal.name} has full control of Automation Account {target.name} (Microsoft.Automation/automationAccounts/*) including runbooks, jobs, credentials, and the managed-identity block.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-account-contributor
emits: CanAdminister
description: Full control of an Automation Account (Automation Contributor / Contributor / Owner).
match_effective_permission:
action: Microsoft.Automation/automationAccounts/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Automation Contributor, Contributor, Owner, or a custom role granting Microsoft.Automation/automationAccounts/*
at the scope
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <automationAccount in scope>
permissions:
- Microsoft.Automation/automationAccounts/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers\
\ automationAccounts/write at the scope. CanAdminister(account) does NOT imply CanGrantPermission\
\ \u2014 escalation is via the account's managed identity (or RunAs SP), not via self role-assignment\
\ or Microsoft.Authorization/*/write."
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/write'
false_positive_note: automationAccounts/* grants control of the account, runbooks, jobs, modules, credentials,
variables, and the identity block, but NOT Microsoft.Authorization/*/write. Escalation is via the
account's managed identity (or RunAs SP), not via self role-assignment. Automation Operator and Automation
Job Operator do NOT grant runbooks/write; they are narrower and do not qualify for CanAdminister.
narrative: '{principal.name} has full control of Automation Account {target.name} (Microsoft.Automation/automationAccounts/*)
including runbooks, jobs, credentials, and the managed-identity block.'