azure-func-execute-as-via-masterkey

Master/host key -> admin runtime API to overwrite+run code as the MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.Web/sites/functions/masterkey/read \| Microsoft.Web/sites/host/listkeys/action` `Microsoft.Web/sites/hostruntime/host/action`
state logic	if service_running(?app): ACTIVE elif matched(optional[0]): CONDITIONAL(service_state) else: CONDITIONAL(service_state)

source type

Identity

target type

Identity

source

<principal>

target

<managed identity>

permissions

Microsoft.Web/sites/functions/masterkey/read | Microsoft.Web/sites/host/listkeys/action Microsoft.Web/sites/hostruntime/host/action

state logic

if service_running(?app): ACTIVE elif matched(optional[0]): CONDITIONAL(service_state) else: CONDITIONAL(service_state)

Narrative

{principal.name} can read the master key of {app.name} and use the admin runtime API to overwrite and run code as its identity {mi.name}.

Raw rule rules/derived/azure/functions.yaml

id: azure-func-execute-as-via-masterkey
emits: CanExecuteAs
description: Master/host key -> admin runtime API to overwrite+run code as the MI.
match:
- - principal: null
  - CanReadSecret
  - key: null
- - app: null
  - ExecutesAs
  - mi: null
where:
- ?key is the master key or host keys of ?app (rule azure-func-master-key OR azure-func-host-listkeys)
- ?mi.privilege_level >= ?principal.privilege_level
optional:
- - principal: null
  - CanStart
  - app: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  state_logic: 'if service_running(?app): ACTIVE

    elif matched(optional[0]): CONDITIONAL(service_state)

    else: CONDITIONAL(service_state)

    '
  conditions_from:
  - app: null
  - mi: null
  permissions:
  - Microsoft.Web/sites/functions/masterkey/read | Microsoft.Web/sites/host/listkeys/action
  - Microsoft.Web/sites/hostruntime/host/action
  derived_from:
  - <CanReadSecret(master key) edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: ONLY the master key (or host/listkeys which includes it) unlocks the admin runtime
    API for code overwrite; per-function keys (azure-func-function-listkeys) do NOT. On a running app
    -> ACTIVE; on a stopped app the edge is still emitted as CONDITIONAL(service_state), realized by CanStart
    (start/action).
  narrative: '{principal.name} can read the master key of {app.name} and use the admin runtime API to
    overwrite and run code as its identity {mi.name}.'