rage.fail

azure-batch-pool-write-config

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Batch/batchAccounts/pools/write", "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<batch pool>`
permissions	`Microsoft.Batch/batchAccounts/pools/write`

Narrative

{principal.name} can rewrite the configuration of pool {target.name} (pools/write) including its managed-identity block and startTask.

Raw rule rules/derived/azure/batch.yaml

id: azure-batch-pool-write-config
emits: CanModifyConfiguration
match_effective_permission:
  action: Microsoft.Batch/batchAccounts/pools/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <batch pool>
  permissions:
  - Microsoft.Batch/batchAccounts/pools/write
  note: Can change the pool identity block (attach user-assigned MI), startTask, env, and resource files;
    alters ExecutesAs and realizes execution at next node (re)create.
  false_positive_note: In-place identity updates do NOT propagate to already-running nodes; scale-to-zero
    then recreate is required, so realized execution may be CONDITIONAL(service_state).
  narrative: '{principal.name} can rewrite the configuration of pool {target.name} (pools/write) including
    its managed-identity block and startTask.'