azure-firewall-policy-rule-groups-write
Write access to Firewall Policy rule collection groups allows an attacker to add or replace NAT, Network, or Application rule collection groups - inserting ALLOW or DNAT entries to open previously blocked network paths.
match (effective permission)
{
"action": "Microsoft.Network/firewallPolicies/ruleCollectionGroups/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Network |
| source | <principal> |
| target | <Azure Firewall linked to this policy (Firewall node)> |
| permissions | Microsoft.Network/firewallPolicies/ruleCollectionGroups/write |
| state logic | ACTIVE: the principal can PUT a modified rule collection group (inserting a high-priority collection to override existing rules); effect realized at next Azure Firewall rule-processing cycle. BLOCKED if deny assignment or Azure Policy deny covers ruleCollectionGroups/write. |
Narrative
{principal.name} can modify rule collection groups on the Firewall Policy affecting {target.name} via Microsoft.Network/firewallPolicies/ruleCollectionGroups/write, enabling insertion of ALLOW or DNAT rules.
Raw rule rules/derived/azure/firewall.yaml
id: azure-firewall-policy-rule-groups-write
emits: CanModifyConfiguration
description: "Write access to Firewall Policy rule collection groups allows an attacker to add or replace\
\ NAT, Network, or Application rule collection groups \u2014 inserting ALLOW or DNAT entries to open\
\ previously blocked network paths."
match_effective_permission:
action: Microsoft.Network/firewallPolicies/ruleCollectionGroups/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Network
source: <principal>
target: <Azure Firewall linked to this policy (Firewall node)>
permissions:
- Microsoft.Network/firewallPolicies/ruleCollectionGroups/write
state_logic: 'ACTIVE: the principal can PUT a modified rule collection group (inserting a high-priority
collection to override existing rules); effect realized at next Azure Firewall rule-processing cycle.
BLOCKED if deny assignment or Azure Policy deny covers ruleCollectionGroups/write.'
false_positive_note: This rule targets the Firewall (Network class) linked to the policy. An attacker
modifying a policy's rule collection group affects all firewalls that reference the policy.
narrative: '{principal.name} can modify rule collection groups on the Firewall Policy affecting {target.name}
via Microsoft.Network/firewallPolicies/ruleCollectionGroups/write, enabling insertion of ALLOW or
DNAT rules.'
derived_from:
- iam:effective_permission(Microsoft.Network/firewallPolicies/ruleCollectionGroups/write, {source},
{target})