azure-disk-admin
Wildcard permission on disks grants full control of the disk resource.
match (effective permission)
{
"action": "Microsoft.Compute/disks/*",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | BlockStorage |
| source | <principal> |
| target | <managed disk in scope> |
| permissions | Microsoft.Compute/disks/* |
Narrative
{principal.name} has full control of managed disk {target.name} (Microsoft.Compute/disks/*), including create, write, delete, SAS export, and policy modification.
Raw rule rules/explicit/azure-disks.yaml
id: azure-disk-admin
emits: CanAdminister
description: Wildcard permission on disks grants full control of the disk resource.
match_effective_permission:
action: Microsoft.Compute/disks/*
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: BlockStorage
source: <principal>
target: <managed disk in scope>
permissions:
- Microsoft.Compute/disks/*
false_positive_note: CanAdminister requires the Microsoft.Compute/disks/* wildcard (Virtual Machine
Contributor, Contributor, or Owner). A custom role granting only disks/read or disks/beginGetAccess/action
without the wildcard does NOT qualify; those narrower grants produce CanExfiltrate or CanRead only.
This does not include Microsoft.Authorization/roleAssignments/write.
narrative: '{principal.name} has full control of managed disk {target.name} (Microsoft.Compute/disks/*),
including create, write, delete, SAS export, and policy modification.'