rage.fail

azure-bp-assignment-executes-as

explicit azure emits ExecutesAs

match (effective permission)

{ "action": [ "read" ], "field": "identity.type", "resource_type": "Microsoft.Blueprint/blueprintAssignments" }

where

identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned']

emit

source type	`BuildWorker`
target type	`ManagedIdentity`
source	`<blueprint assignment>`
target	`<managed identity (system-assigned principalId or user-assigned keys from identity.userAssignedIdentities)>`

Narrative

Blueprint assignment {assignment.name} executes as managed identity {mi.name} (type: {identity.type}).

Raw rule rules/explicit/azure-blueprints.yaml

id: azure-bp-assignment-executes-as
emits: ExecutesAs
applies_to:
- azure
match_effective_permission:
  action:
  - read
  resource_type: Microsoft.Blueprint/blueprintAssignments
  field: identity.type
where:
- identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned']
emit:
  source_type: BuildWorker
  target_type: ManagedIdentity
  source: <blueprint assignment>
  target: <managed identity (system-assigned principalId or user-assigned keys from identity.userAssignedIdentities)>
  conditions: []
  api_source: 'Azure ARM: Microsoft.Blueprint/blueprintAssignments GET (identity block)'
  narrative: 'Blueprint assignment {assignment.name} executes as managed identity {mi.name} (type: {identity.type}).'