azure-containerapps-sessionpool-execute

id: azure-containerapps-sessionpool-execute
emits: CanExecuteCommand
description: Executing code in a custom-container session pool runs attacker-supplied code in the sandbox;
  if the pool binds a reachable MI this is a CanExecuteAs primitive identical to the app exec path.
match_effective_permission:
  action: Microsoft.App/sessionPools/executeSessionCommand/action
  data_action: true
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: ContainerService
  source: <principal>
  target: <sessionPool (ContainerService)>
  permissions:
  - Microsoft.App/sessionPools/executeSessionCommand/action
  conditions:
  - service_state
  state_logic: ACTIVE if the session pool has an allocated/ready session; otherwise CONDITIONAL(service_state)
    until a session is allocated
  false_positive_note: Session execution is a DATA ACTION granted by the 'Azure ContainerApps Session
    Executor' role (or a custom role), NOT by control-plane wildcards. Only escalation-relevant for CUSTOM-CONTAINER
    session pools that bind a managed identity reachable from the executing session; the built-in code-interpreter
    pool type does not expose a bindable app MI to session code. Verify the exact data-action string and
    the pool container/identity binding via `az provider operation show --namespace Microsoft.App`.
  narrative: '{principal.name} can execute code in a session of pool {target.name} (Microsoft.App/sessionPools/executeSessionCommand/action).'