azure-auto-jobs-write
Start a runbook job in an Automation Account (cloud sandbox or hybrid worker).
match (effective permission)
{
"action": "Microsoft.Automation/automationAccounts/jobs/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Automation Operator, Automation Job Operator, Automation Contributor, Contributor, Owner, or a custom role granting jobs/write
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <runbook (BuildWorker) in the automationAccount> |
| permissions | Microsoft.Automation/automationAccounts/jobs/write |
| conditions | service_state |
| state logic | ACTIVE when the effective permission is confirmed and the account is not suspended. CONDITIONAL(service_state) if the account is suspended or the target runbook is not in Published state. For hybrid worker paths, also CONDITIONAL(service_state) if the targeted HybridRunbookWorkerGroup has no registered workers. BLOCKED if a deny assignment covers jobs/write. |
Narrative
{principal.name} can start runbook jobs in Automation Account {target.name} (automationAccounts/jobs/write); cicd-chains rule 2 derives CanExecuteAs(MI) CONDITIONAL on the current runbook definition running attacker-influenced code (ACTIVE when combined with CanModifyCode via azure-auto-runbook-write).
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-jobs-write
emits: CanTrigger
description: Start a runbook job in an Automation Account (cloud sandbox or hybrid worker).
match_effective_permission:
action: Microsoft.Automation/automationAccounts/jobs/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Automation Operator, Automation Job Operator, Automation Contributor, Contributor,
Owner, or a custom role granting jobs/write
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <runbook (BuildWorker) in the automationAccount>
permissions:
- Microsoft.Automation/automationAccounts/jobs/write
conditions:
- service_state
state_logic: ACTIVE when the effective permission is confirmed and the account is not suspended. CONDITIONAL(service_state)
if the account is suspended or the target runbook is not in Published state. For hybrid worker paths,
also CONDITIONAL(service_state) if the targeted HybridRunbookWorkerGroup has no registered workers.
BLOCKED if a deny assignment covers jobs/write.
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/jobs/write'
- 'cicd-chains.yaml: cicd-trigger-runner-executes-as (rule 2, CONDITIONAL unless definition is attacker-influenced)'
false_positive_note: "jobs/write alone triggers the CURRENT runbook definition. cicd-chains rule 2 keeps\
\ this CONDITIONAL(attacker_influenced_definition) unless the current runbook definition already contains\
\ attacker-influenced code. When combined with runbooks/write (azure-auto-runbook-write), the CanModifyCode\
\ + CanTrigger pair makes the MODIFY path (rule 1) ACTIVE. A principal with jobs/write but NOT runbooks/write\
\ can only trigger existing (trusted) runbooks \u2014 this is the weaker trigger-only path."
narrative: '{principal.name} can start runbook jobs in Automation Account {target.name} (automationAccounts/jobs/write);
cicd-chains rule 2 derives CanExecuteAs(MI) CONDITIONAL on the current runbook definition running
attacker-influenced code (ACTIVE when combined with CanModifyCode via azure-auto-runbook-write).'