azure-firewall-policy-write-attach
Write access to a Firewall Policy enables replacing or re-parenting the policy's basePolicy (policy hierarchy inheritance) or attaching the policy to additional Azure Firewalls, amplifying blast radius when a single policy controls multiple firewalls. This is a distinct capability from ruleCollectionGroups/write (which modifies rules only).
match (effective permission)
{
"action": "Microsoft.Network/firewallPolicies/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Policy |
| source | <principal> |
| target | <Firewall Policy (GenericPolicy node)> |
| permissions | Microsoft.Network/firewallPolicies/write |
| state logic | ACTIVE: the principal can PUT a modified policy object (replacing basePolicy reference or reassigning firewall attachments); effect realized immediately in the policy control plane. BLOCKED if deny assignment or Azure Policy deny covers firewallPolicies/write. |
Narrative
{principal.name} can modify Firewall Policy {target.name} via Microsoft.Network/firewallPolicies/write, enabling replacement of the basePolicy hierarchy or reassignment to additional firewalls.
Raw rule rules/derived/azure/firewall.yaml
id: azure-firewall-policy-write-attach
emits: CanModifyPolicy
description: Write access to a Firewall Policy enables replacing or re-parenting the policy's basePolicy
(policy hierarchy inheritance) or attaching the policy to additional Azure Firewalls, amplifying blast
radius when a single policy controls multiple firewalls. This is a distinct capability from ruleCollectionGroups/write
(which modifies rules only).
match_effective_permission:
action: Microsoft.Network/firewallPolicies/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Policy
source: <principal>
target: <Firewall Policy (GenericPolicy node)>
permissions:
- Microsoft.Network/firewallPolicies/write
state_logic: 'ACTIVE: the principal can PUT a modified policy object (replacing basePolicy reference
or reassigning firewall attachments); effect realized immediately in the policy control plane. BLOCKED
if deny assignment or Azure Policy deny covers firewallPolicies/write.'
false_positive_note: This is a POLICY mutation, not a rule-set edit. Changing basePolicy can inherit
rules from a parent (escalation via hierarchy). Reassigning firewall attachments multiplies the blast
radius across multiple firewalls.
narrative: '{principal.name} can modify Firewall Policy {target.name} via Microsoft.Network/firewallPolicies/write,
enabling replacement of the basePolicy hierarchy or reassignment to additional firewalls.'
derived_from:
- iam:effective_permission(Microsoft.Network/firewallPolicies/write, {source}, {target})