rage.fail

azure-func-create-workload-as

Create a new Function app bound to a passable user-assigned MI, deploy code, execute as the MI.

derived azure emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'userMI': None} {'principal': None} CanModifyCode {'app': None}

where

?principal has EFFECTIVE Microsoft.Web/sites/write (create/configure the app) on ?app ?userMI.privilege_level >= ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<user-assigned managed identity>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Web/sites/write` `Microsoft.Web/sites/functions/write \| extensions/write`
conditions	`role_compatibility`

Narrative

{principal.name} can create/configure a Function app bound to user-assigned MI {userMI.name}, deploy code, and execute as {userMI.name}.

Raw rule rules/derived/azure/functions.yaml

id: azure-func-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new Function app bound to a passable user-assigned MI, deploy code, execute as the
  MI.
match:
- - principal: null
  - CanPassIdentity
  - userMI: null
- - principal: null
  - CanModifyCode
  - app: null
where:
- ?principal has EFFECTIVE Microsoft.Web/sites/write (create/configure the app) on ?app
- ?userMI.privilege_level >= ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <user-assigned managed identity>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Web/sites/write
  - Microsoft.Web/sites/functions/write | extensions/write
  conditions:
  - role_compatibility
  derived_from:
  - <CanPassIdentity edge_id>
  - <CanModifyCode edge_id>
  false_positive_note: Requires the pass/attach chain (assign/action on ?userMI + sites/write) AND a code/deploy
    primitive on that app. ?userMI is bound by the CanPassIdentity match term. Escalation only if the
    passed MI out-privileges the caller.
  narrative: '{principal.name} can create/configure a Function app bound to user-assigned MI {userMI.name},
    deploy code, and execute as {userMI.name}.'