rage.fail

azure-func-execute-as-via-publish

Publishing (SCM/Kudu/FTP) credentials -> push code -> execute as the MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadSecret {'creds': None} {'app': None} ExecutesAs {'mi': None}

where

?creds are the SCM/FTP publishing credentials of ?app (rule azure-func-publishing-creds) ?mi.privilege_level >= ?principal.privilege_level SCM/FTP basic auth is ENABLED (basicPublishingCredentialsPolicies allow)

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.Web/sites/config/list/Action` `Microsoft.Web/sites/publish/Action`

Narrative

{principal.name} can extract SCM/FTP publishing creds of {app.name}, push code via Kudu/FTP, and execute as its identity {mi.name}.

Raw rule rules/derived/azure/functions.yaml

id: azure-func-execute-as-via-publish
emits: CanExecuteAs
description: Publishing (SCM/Kudu/FTP) credentials -> push code -> execute as the MI.
match:
- - principal: null
  - CanReadSecret
  - creds: null
- - app: null
  - ExecutesAs
  - mi: null
where:
- ?creds are the SCM/FTP publishing credentials of ?app (rule azure-func-publishing-creds)
- ?mi.privilege_level >= ?principal.privilege_level
- SCM/FTP basic auth is ENABLED (basicPublishingCredentialsPolicies allow)
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  conditions_from:
  - app: null
  - mi: null
  permissions:
  - Microsoft.Web/sites/config/list/Action
  - Microsoft.Web/sites/publish/Action
  derived_from:
  - <CanReadSecret(publishing creds) edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: BLOCKED if SCM/FTP basic auth is disabled via basicPublishingCredentialsPolicies.
    Requires the MI to out-privilege the caller.
  narrative: '{principal.name} can extract SCM/FTP publishing creds of {app.name}, push code via Kudu/FTP,
    and execute as its identity {mi.name}.'