azure-dns-public-zone-admin
Full administrative control over a public Azure DNS zone (DNS Zone Contributor or equivalent): the principal can manage all record types, zone settings, and zone-level RBAC delegation (where Owner scope is held).
match (effective permission)
{
"action": "Microsoft.Network/dnsZones/*",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds
DNS Zone Contributor, Network Contributor, Contributor, or Owner; OR a custom role with Microsoft.Network/dnsZones/* at the zone or parent scope
emit
| source type | Identity |
|---|---|
| target type | DNS |
| source | <principal> |
| target | <public DNS zone> |
| permissions | Microsoft.Network/dnsZones/write Microsoft.Network/dnsZones/*/write |
| state logic | ACTIVE: the principal has full control of the zone and all its record sets immediately. A deny assignment at the zone or parent scope -> BLOCKED. |
Narrative
{principal.name} has full administrative control of public DNS zone {target.name} (Microsoft.Network/dnsZones/*), enabling creation, modification, and deletion of all record sets. Combined with can-control.yaml, this yields Controls({target.name}).
Raw rule rules/derived/azure/dns.yaml
id: azure-dns-public-zone-admin
emits: CanAdminister
description: 'Full administrative control over a public Azure DNS zone (DNS Zone Contributor or equivalent):
the principal can manage all record types, zone settings, and zone-level RBAC delegation (where Owner
scope is held).'
match_effective_permission:
action: Microsoft.Network/dnsZones/*
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds DNS Zone Contributor, Network Contributor, Contributor, or Owner; OR a custom
role with Microsoft.Network/dnsZones/* at the zone or parent scope
emit:
source_type: Identity
target_type: DNS
source: <principal>
target: <public DNS zone>
permissions:
- Microsoft.Network/dnsZones/write
- Microsoft.Network/dnsZones/*/write
state_logic: 'ACTIVE: the principal has full control of the zone and all its record sets immediately.
A deny assignment at the zone or parent scope -> BLOCKED.'
derived_from:
- '<effective RBAC record: dnsZones/* or DNS Zone Contributor at zone scope>'
false_positive_note: DNS Zone Contributor does NOT include Microsoft.Authorization/*/write; the principal
cannot self-assign roles on the zone. Owner does include authorization write. The CanAdminister ->
Controls derivation is handled by can-control.yaml (cited, not duplicated here). DNS Zone Contributor
applies only to public zones; it does not grant privateDnsZones/* operations.
narrative: '{principal.name} has full administrative control of public DNS zone {target.name} (Microsoft.Network/dnsZones/*),
enabling creation, modification, and deletion of all record sets. Combined with can-control.yaml,
this yields Controls({target.name}).'