rage.fail

azure-bp-assignment-write

explicit azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Blueprint/blueprintAssignments/write", "scope_type": "subscription|managementGroup" }

emit

source type	`Identity`
target type	`BuildWorker`
source	`<principal>`
target	`<blueprint assignment>`
permissions	`Microsoft.Blueprint/blueprintAssignments/write`
conditions	`role_compatibility`

Narrative

{principal.name} can write blueprint assignments (Microsoft.Blueprint/blueprintAssignments/write), gaining CanModifyConfiguration over the assignment and implicit CanTrigger.

Raw rule rules/explicit/azure-blueprints.yaml

id: azure-bp-assignment-write
emits: CanModifyConfiguration
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Blueprint/blueprintAssignments/write
  scope_type: subscription|managementGroup
where: []
emit:
  source_type: Identity
  target_type: BuildWorker
  source: <principal>
  target: <blueprint assignment>
  permissions:
  - Microsoft.Blueprint/blueprintAssignments/write
  conditions:
  - role_compatibility
  api_source: 'Azure ARM: roleAssignments query filtered by Microsoft.Blueprint/blueprintAssignments/write'
  narrative: '{principal.name} can write blueprint assignments (Microsoft.Blueprint/blueprintAssignments/write),
    gaining CanModifyConfiguration over the assignment and implicit CanTrigger.'