rage.fail

azure-func-execute-as-via-config

Config modification (run-from-package / image / startup) + ExecutesAs => execute as the MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'app': None} {'app': None} ExecutesAs {'mi': None}

where

node_type(?app) in [ServerlessFunction, ApplicationPlatform] ?mi.privilege_level >= ?principal.privilege_level

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanInvoke {'app': None}

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.Web/sites/config/Write`
state logic	if matched(optional[0]) or trigger_exists(?app): ACTIVE else: CONDITIONAL(trigger_exists)

Narrative

{principal.name} can change {app.name} config (WEBSITE_RUN_FROM_PACKAGE / image / startup) and execute as its identity {mi.name}.

Raw rule rules/derived/azure/functions.yaml

id: azure-func-execute-as-via-config
emits: CanExecuteAs
description: Config modification (run-from-package / image / startup) + ExecutesAs => execute as the MI.
match:
- - principal: null
  - CanModifyConfiguration
  - app: null
- - app: null
  - ExecutesAs
  - mi: null
where:
- node_type(?app) in [ServerlessFunction, ApplicationPlatform]
- ?mi.privilege_level >= ?principal.privilege_level
optional:
- - principal: null
  - CanInvoke
  - app: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  state_logic: 'if matched(optional[0]) or trigger_exists(?app): ACTIVE

    else: CONDITIONAL(trigger_exists)

    '
  conditions_from:
  - app: null
  - mi: null
  permissions:
  - Microsoft.Web/sites/config/Write
  derived_from:
  - <CanModifyConfiguration edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: config/Write is only execution when it changes the running package/image/startup
    or injects code; a benign setting change is not execution. Requires the MI to out-privilege the caller.
  narrative: '{principal.name} can change {app.name} config (WEBSITE_RUN_FROM_PACKAGE / image / startup)
    and execute as its identity {mi.name}.'