rage.fail

azure-batch-create-workload-as-via-attach-mi

Attach a privileged user-assigned MI to a controlled/new pool, add a startTask, and execute as the MI.

derived azure emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanAttachIdentity {'pool': None} {'principal': None} CanModifyCode {'pool': None}

where

?userMI.privilege_level >= ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<user-assigned managed identity>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Batch/batchAccounts/pools/write`
conditions	`role_compatibility` `service_state`

Narrative

{principal.name} can attach user-assigned MI {userMI.name} to a pool it can set a startTask on, executing as {userMI.name}.

Raw rule rules/derived/azure/batch.yaml

id: azure-batch-create-workload-as-via-attach-mi
emits: CanCreateWorkloadAs
description: Attach a privileged user-assigned MI to a controlled/new pool, add a startTask, and execute
  as the MI.
match:
- - principal: null
  - CanAttachIdentity
  - pool: null
- - principal: null
  - CanModifyCode
  - pool: null
where:
- ?userMI.privilege_level >= ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <user-assigned managed identity>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Batch/batchAccounts/pools/write
  conditions:
  - role_compatibility
  - service_state
  derived_from:
  - <CanAttachIdentity edge_id>
  - <CanModifyCode edge_id>
  false_positive_note: Requires the attach chain (assign/action + pools/write) AND a startTask/task on
    that pool. Escalation only if the attached MI out-privileges the caller. Zero-node pool -> CONDITIONAL(service_state).
  narrative: '{principal.name} can attach user-assigned MI {userMI.name} to a pool it can set a startTask
    on, executing as {userMI.name}.'