rage.fail

azure-bp-assignment-trigger

explicit azure emits CanTrigger

match (effective permission)

{ "action": "Microsoft.Blueprint/blueprintAssignments/write", "scope_type": "subscription|managementGroup" }

emit

source type	`Identity`
target type	`BuildWorker`
source	`<principal>`
target	`<blueprint assignment>`
permissions	`Microsoft.Blueprint/blueprintAssignments/write`
conditions	`role_compatibility`

Narrative

{principal.name} can write a blueprint assignment (blueprintAssignments/write), which immediately triggers its deployment.

Raw rule rules/explicit/azure-blueprints.yaml

id: azure-bp-assignment-trigger
emits: CanTrigger
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Blueprint/blueprintAssignments/write
  scope_type: subscription|managementGroup
where: []
emit:
  source_type: Identity
  target_type: BuildWorker
  source: <principal>
  target: <blueprint assignment>
  permissions:
  - Microsoft.Blueprint/blueprintAssignments/write
  conditions:
  - role_compatibility
  api_source: 'Azure ARM: roleAssignments query filtered by Microsoft.Blueprint/blueprintAssignments/write'
  narrative: '{principal.name} can write a blueprint assignment (blueprintAssignments/write), which immediately
    triggers its deployment.'