azure-containerapps-execute-as-via-write
Control-plane image/command replacement + the app runs as an MI => execute as that MI (via the identity endpoint).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?app) in [
ContainerService, BatchJob]
?mi.privilege_level > ?principal.privilege_level # strict escalation only (equal-privilege lateral excluded)
?mi is reachable from the main container (identitySettings.lifecycle in [All, Main] or unset)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <managed identity> |
| permissions | Microsoft.App/containerApps/write |
Narrative
{principal.name} can replace the image/command of {app.name} (containerApps/write) and mint the token of its identity {mi.name} from the local identity endpoint, executing as {mi.name}.
Raw rule rules/derived/azure/containerapps.yaml
id: azure-containerapps-execute-as-via-write
emits: CanExecuteAs
description: Control-plane image/command replacement + the app runs as an MI => execute as that MI (via
the identity endpoint).
match:
- - principal: null
- CanModifyCode
- app: null
- - app: null
- ExecutesAs
- mi: null
where:
- node_type(?app) in [ContainerService, BatchJob]
- '?mi.privilege_level > ?principal.privilege_level # strict escalation only (equal-privilege lateral
excluded)'
- ?mi is reachable from the main container (identitySettings.lifecycle in [All, Main] or unset)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <managed identity>
conditions_from:
- app: null
- mi: null
permissions:
- Microsoft.App/containerApps/write
derived_from:
- <CanModifyCode edge_id>
- <ExecutesAs edge_id>
false_positive_note: Emit only when the app has an MI reachable from the main container and that MI
out-privileges the caller. containerApps/write alone (no exec) is sufficient because the new revision
runs attacker code.
narrative: '{principal.name} can replace the image/command of {app.name} (containerApps/write) and mint
the token of its identity {mi.name} from the local identity endpoint, executing as {mi.name}.'