rage.fail

azure-evg-domain-contains-topic

explicit azure emits CanAdminister

match (record)

{ "field": "id", "resource_type": "Microsoft.EventGrid/domains/topics" }

emit

source type	`Identity`
target type	`*`
source	`<principal with administrative access to the Event Grid domain>`
target	`<domain topic>`

Narrative

A principal with administrative control of Event Grid domain {domain.name} can administer all domain topics, including {topic.name}.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-domain-contains-topic
emits: CanAdminister
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/domains/topics
  field: id
emit:
  source_type: Identity
  target_type: '*'
  source: <principal with administrative access to the Event Grid domain>
  target: <domain topic>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/domains/{domain}/topics
  evidence_field: id
  note: 'An Event Grid domain is a Messaging resource (EventBus), not an AdministrativeBoundary. The logical
    containment relationship is replaced with CanAdminister: a principal with admin access to the domain
    has control over all domain topics. This is more semantically accurate than a structural Contains
    edge, which is reserved for AdministrativeBoundary.source. Alternatively, if the domain-to-topic containment
    is purely structural recon, it can be removed entirely in favor of resource-group-level Contains edges
    (azure-evg-rg-contains-domain).'
  narrative: A principal with administrative control of Event Grid domain {domain.name} can administer
    all domain topics, including {topic.name}.