azure-dns-private-zone-admin
Full administrative control over a private Azure DNS zone (Private DNS Zone Contributor or equivalent): the principal can manage all record types, zone settings, and VNet links.
match (effective permission)
{
"action": "Microsoft.Network/privateDnsZones/*",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Private
DNS Zone Contributor, Network Contributor, Contributor, or Owner; OR a custom role with Microsoft.Network/privateDnsZones/* at the zone or parent scope
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <private DNS zone> |
| permissions | Microsoft.Network/privateDnsZones/write Microsoft.Network/privateDnsZones/*/write Microsoft.Network/privateDnsZones/virtualNetworkLinks/write |
| state logic | ACTIVE: the principal has full control of the private zone, all its record sets, and VNet links immediately. A deny assignment -> BLOCKED. |
Narrative
{principal.name} has full administrative control of private DNS zone {target.name} (Microsoft.Network/privateDnsZones/*), enabling management of all internal record sets and VNet links. Combined with can-control.yaml, this yields Controls({target.name}).
Raw rule rules/derived/azure/dns.yaml
id: azure-dns-private-zone-admin
emits: CanAdminister
description: 'Full administrative control over a private Azure DNS zone (Private DNS Zone Contributor
or equivalent): the principal can manage all record types, zone settings, and VNet links.'
match_effective_permission:
action: Microsoft.Network/privateDnsZones/*
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Private DNS Zone Contributor, Network Contributor, Contributor, or Owner;
OR a custom role with Microsoft.Network/privateDnsZones/* at the zone or parent scope
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <private DNS zone>
permissions:
- Microsoft.Network/privateDnsZones/write
- Microsoft.Network/privateDnsZones/*/write
- Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
state_logic: 'ACTIVE: the principal has full control of the private zone, all its record sets, and VNet
links immediately. A deny assignment -> BLOCKED.'
derived_from:
- '<effective RBAC record: privateDnsZones/* or Private DNS Zone Contributor at zone scope>'
false_positive_note: Private DNS Zone Contributor does NOT include Microsoft.Authorization/*/write.
It also does NOT grant dnsZones/* (public zones). The CanAdminister -> Controls derivation is handled
by can-control.yaml (cited, not duplicated here). Operational impact requires at least one active
VNet link; CanAdminister is still emitted when no link exists (the principal still has the capability),
but downstream edges should note the CONDITIONAL(service_state) dependency.
narrative: '{principal.name} has full administrative control of private DNS zone {target.name} (Microsoft.Network/privateDnsZones/*),
enabling management of all internal record sets and VNet links. Combined with can-control.yaml, this
yields Controls({target.name}).'