rage.fail

azure-bp-deny-assignment-attached

explicit azure emits HasPolicy

match (effective permission)

{ "action": [ "read" ], "field": "properties.createdBy", "resource_type": "Microsoft.Authorization/denyAssignments" }

where

createdBy resource_id matches Microsoft.Blueprint/blueprintAssignments or Microsoft.Resources/deploymentStacks

emit

source type	`BuildWorker`
target type	`ConditionalPolicy`
source	`<blueprint assignment or deployment stack (extracted from createdBy resource_id)>`
target	`<deny assignment (ConditionalPolicy)>`

Narrative

{assignment.name} (blueprint assignment or deployment stack) created and owns deny assignment {deny.name}.

Raw rule rules/explicit/azure-blueprints.yaml

id: azure-bp-deny-assignment-attached
emits: HasPolicy
applies_to:
- azure
match_effective_permission:
  action:
  - read
  resource_type: Microsoft.Authorization/denyAssignments
  field: properties.createdBy
where:
- createdBy resource_id matches Microsoft.Blueprint/blueprintAssignments or Microsoft.Resources/deploymentStacks
emit:
  source_type: BuildWorker
  target_type: ConditionalPolicy
  source: <blueprint assignment or deployment stack (extracted from createdBy resource_id)>
  target: <deny assignment (ConditionalPolicy)>
  conditions: []
  api_source: 'Azure ARM: Microsoft.Authorization/denyAssignments GET (properties.createdBy)'
  narrative: '{assignment.name} (blueprint assignment or deployment stack) created and owns deny assignment
    {deny.name}.'