rage.fail

azure-containerapps-sessionpool-executes-as-mi

derived azure emits ExecutesAs

where

identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned', 'SystemAssigned,UserAssigned'] the pool is a custom-container pool whose session containers can reach the identity endpoint (not a locked-down code-interpreter pool)

emit

source type	`Compute`
source	`<sessionPool (ContainerService)>`
target	`<each MI bound to the session pool>`

Narrative

Session pool {pool.name} runs sessions as managed identity {mi.name}.

Raw rule rules/derived/azure/containerapps.yaml

id: azure-containerapps-sessionpool-executes-as-mi
emits: ExecutesAs
source_config:
  resource_type: Microsoft.App/sessionPools
  field: identity
where:
- identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned', 'SystemAssigned,UserAssigned']
- the pool is a custom-container pool whose session containers can reach the identity endpoint (not a
  locked-down code-interpreter pool)
emit:
  source_type: Compute
  source: <sessionPool (ContainerService)>
  target: <each MI bound to the session pool>
  note: Only emit for custom-container session pools where executed code can reach the local identity
    endpoint. If the pool cannot expose a bindable MI to session code, omit this fact so no CanExecuteAs
    is derived.
  narrative: Session pool {pool.name} runs sessions as managed identity {mi.name}.