azure-auto-attach-user-mi

Attach a user-assigned managed identity to an Automation Account (Azure PassRole analog); subsequent runbooks execute as that MI.

derived azure emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`GenericCompute`
source	`?principal`
target	`<Automation Account (AutomationService)>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Automation/automationAccounts/write`
conditions	`role_compatibility`
state logic	ACTIVE when BOTH permissions are confirmed: assign/action on the MI AND automationAccounts/write on the account. CONDITIONAL(role_compatibility) when only one permission is confirmed. A new or existing account with automationAccounts/write alone cannot attach a user-assigned MI without assign/action on that specific MI. BLOCKED if a deny assignment covers either permission.

source type

Identity

target type

GenericCompute

source

?principal

target

<Automation Account (AutomationService)>

permissions

Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.Automation/automationAccounts/write

conditions

role_compatibility

state logic

ACTIVE when BOTH permissions are confirmed: assign/action on the MI AND automationAccounts/write on the account. CONDITIONAL(role_compatibility) when only one permission is confirmed. A new or existing account with automationAccounts/write alone cannot attach a user-assigned MI without assign/action on that specific MI. BLOCKED if a deny assignment covers either permission.

Narrative

{principal.name} can attach user-assigned managed identity {mi.name} to an Automation Account (assign/action + automationAccounts/write); subsequent runbooks in the account execute as {mi.name} and can mint its ARM token from IMDS.

Raw rule rules/derived/azure/automation.yaml

id: azure-auto-attach-user-mi
emits: CanAttachIdentity
description: Attach a user-assigned managed identity to an Automation Account (Azure PassRole analog);
  subsequent runbooks execute as that MI.
match:
- - principal: null
  - CanPassIdentity
  - mi: null
where:
- ?principal also has EFFECTIVE Microsoft.Automation/automationAccounts/write on the target account
- node_type(?mi) == ManagedIdentity
emit:
  source_type: Identity
  target_type: GenericCompute
  source: ?principal
  target: <Automation Account (AutomationService)>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Automation/automationAccounts/write
  conditions:
  - role_compatibility
  state_logic: 'ACTIVE when BOTH permissions are confirmed: assign/action on the MI AND automationAccounts/write
    on the account. CONDITIONAL(role_compatibility) when only one permission is confirmed. A new or existing
    account with automationAccounts/write alone cannot attach a user-assigned MI without assign/action
    on that specific MI. BLOCKED if a deny assignment covers either permission.'
  confidence: 0.95
  derived_from:
  - 'azure identity-escalation.yaml: azure-assign-user-assigned-mi (CanPassIdentity)'
  - 'azure-auto-account-contributor: Microsoft.Automation/automationAccounts/write'
  - 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration + CanPassIdentity
    => CanExecuteAs via new/modified account)'
  false_positive_note: 'BOTH permissions are required: assign/action on the MI scope AND automationAccounts/write
    on the account. A Contributor at resource-group scope inherits both for resources in that RG; a narrower
    Automation Contributor does NOT include assign/action on MIs in other resource groups. Honor the assign/action
    scope: if the MI is in a different subscription, the attacker needs assign/action at that subscription/MI
    scope.'
  narrative: '{principal.name} can attach user-assigned managed identity {mi.name} to an Automation Account
    (assign/action + automationAccounts/write); subsequent runbooks in the account execute as {mi.name}
    and can mint its ARM token from IMDS.'