rage.fail

azure-evg-namespace-permission-binding

explicit azure emits HasPolicy

match (record)

{ "field": "properties.permission", "resource_type": "Microsoft.EventGrid/namespaces/permissionBindings" }

where

properties.permission in [Publisher, Subscriber]

emit

source type	`*`
target type	`Policy`
source	`<MQTT client group (Group node)>`
target	`<topic space permission binding (GenericPolicy node)>`

Narrative

Permission binding {target.name} grants client group {source.name} {properties.permission} permission on topic space {properties.topicSpaceName} in Event Grid namespace.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-namespace-permission-binding
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/namespaces/permissionBindings
  field: properties.permission
where:
- properties.permission in [Publisher, Subscriber]
emit:
  source_type: '*'
  target_type: Policy
  source: <MQTT client group (Group node)>
  target: <topic space permission binding (GenericPolicy node)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/namespaces/{namespace}/permissionBindings
  evidence_field: properties.permission + properties.topicSpaceName + properties.clientGroupName
  note: "A permission binding grants the client group (Publisher or Subscriber) permission on the named\
    \ topic space pattern. Publisher permission \u2192 any client in the group can send MQTT messages\
    \ to matching topics (CanWriteData equivalent in the MQTT plane). Subscriber permission \u2192 can\
    \ receive messages from matching topics (CanReadData). Record clientGroupName and topicSpaceName for\
    \ downstream path-finding."
  narrative: Permission binding {target.name} grants client group {source.name} {properties.permission}
    permission on topic space {properties.topicSpaceName} in Event Grid namespace.