azure-frontdoor-contributor

id: azure-frontdoor-contributor
emits: CanAdminister
description: 'Write access to the AFD profile object (Microsoft.Cdn/profiles/*) grants full control: endpoints,
  origin groups, origins, security policies, WAF links, rule sets, and custom domains.'
match_effective_permission:
  action: Microsoft.Cdn/profiles/*
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds CDN Contributor / Contributor / Owner or a custom role granting Microsoft.Cdn/profiles/*
  at the scope
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <AFD profile node (Microsoft.Cdn/profiles)>
  permissions:
  - Microsoft.Cdn/profiles/*
  state_logic: ACTIVE
  false_positive_note: "CDN Contributor grants Microsoft.Cdn/profiles/* (all sub-resources, including\
    \ endpoints, origins, security policies, rule sets) but NOT Microsoft.Authorization/*/write; it does\
    \ not enable RBAC self-assignment. A grant of only Microsoft.Cdn/profiles/write (create/replace the\
    \ profile object alone, without wildcard sub-resource control) should NOT emit CanAdminister \u2014\
    \ emit CanModifyConfiguration instead on specific sub-resources. This rule applies only to principals\
    \ holding profiles/* (wildcard), which is CDN Contributor, Contributor, Owner, or a custom role bundling\
    \ that permission. CDN Endpoint Contributor grants only endpoint-scoped sub-resources (afdEndpoints/*,\
    \ originGroups/*, origins/*, ruleSets/*, securityPolicies/*) but NOT profiles/* or profiles/write\
    \ itself; do not emit CanAdminister for it. CanAdminister \u2192 Controls is derived by can-control.yaml\
    \ (cited, not duplicated here)."
  narrative: '{principal.name} has full administrative control of AFD profile {target.name} (Microsoft.Cdn/profiles/*),
    including all endpoints, origin groups, WAF links, rule sets, and custom domains.'