rage.fail

azure-containerapps-job-exec

derived azure emits CanExecuteCommand

match (effective permission)

{ "action": "Microsoft.App/jobs/exec/action", "data_action": true, "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
source	`<principal>`
target	`<containerApps job (running job execution)>`
permissions	`Microsoft.App/jobs/exec/action`
conditions	`service_state`
state logic	ACTIVE if the job has a running execution; if no execution is currently running, CONDITIONAL(service_state) and pair with jobs/start/action (azure-containerapps-job-start) to launch one

Narrative

{principal.name} can open a shell in a running execution of job {target.name} (Microsoft.App/jobs/exec/action) and read the container identity endpoint to mint the job's managed-identity token.

Raw rule rules/derived/azure/containerapps.yaml

id: azure-containerapps-job-exec
emits: CanExecuteCommand
match_effective_permission:
  action: Microsoft.App/jobs/exec/action
  data_action: true
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  source: <principal>
  target: <containerApps job (running job execution)>
  permissions:
  - Microsoft.App/jobs/exec/action
  conditions:
  - service_state
  state_logic: ACTIVE if the job has a running execution; if no execution is currently running, CONDITIONAL(service_state)
    and pair with jobs/start/action (azure-containerapps-job-start) to launch one
  false_positive_note: jobs/exec/action is a DATA ACTION (Container Apps Operator / custom role), NOT
    granted by control-plane wildcards. Requires a RUNNING job execution to shell into; an idle job with
    no active execution yields CONDITIONAL(service_state) until started. Same identity-endpoint token-mint
    primitive as the app exec path.
  narrative: '{principal.name} can open a shell in a running execution of job {target.name} (Microsoft.App/jobs/exec/action)
    and read the container identity endpoint to mint the job''s managed-identity token.'