rage.fail

azure-containerapps-exec

derived azure emits CanExecuteCommand

match (effective permission)

{ "action": "Microsoft.App/containerApps/exec/action", "data_action": true, "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
source	`<principal>`
target	`<containerApp>`
permissions	`Microsoft.App/containerApps/exec/action`
conditions	`service_state`
state logic	ACTIVE if the app has >=1 running replica; if min-replicas 0 and idle, CONDITIONAL(service_state) and pair with a trigger/scale-up

Narrative

{principal.name} can open a shell in a running replica of {target.name} (Microsoft.App/containerApps/exec/action) and read the container identity endpoint.

Raw rule rules/derived/azure/containerapps.yaml

id: azure-containerapps-exec
emits: CanExecuteCommand
match_effective_permission:
  action: Microsoft.App/containerApps/exec/action
  data_action: true
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  source: <principal>
  target: <containerApp>
  permissions:
  - Microsoft.App/containerApps/exec/action
  conditions:
  - service_state
  state_logic: ACTIVE if the app has >=1 running replica; if min-replicas 0 and idle, CONDITIONAL(service_state)
    and pair with a trigger/scale-up
  false_positive_note: exec/action is a DATA ACTION granted by Container Apps Operator (or a custom role),
    NOT by Container Apps Contributor/Owner control-plane wildcards. Requires a running replica; a scaled-to-zero
    app yields CONDITIONAL(service_state).
  narrative: '{principal.name} can open a shell in a running replica of {target.name} (Microsoft.App/containerApps/exec/action)
    and read the container identity endpoint.'