azure-func-slots-swap

id: azure-func-slots-swap
emits: CanModifyCode
description: Swap a controlled slot into a higher-privilege slot -> the swapped-in code runs under the
  target slot's (more privileged) managed identity.
match_effective_permission:
  action: Microsoft.Web/sites/slotsswap/Action
  scope_type: resource|resourceGroup|subscription
where:
- ?principal effectively holds Microsoft.Web/sites/slotsswap/Action OR Microsoft.Web/sites/slots/slotsswap/Action
  on the source slot
- ?principal can stage code/config on the source slot (slots/functions/write | slots/extensions/write
  | slots/config/Write) or already controls it
- the swap-target slot ExecutesAs a managed identity (its own binding is what the swapped-in code inherits)
emit:
  source_type: Identity
  source: <principal>
  target: <swap-target slot / production site>
  permissions:
  - Microsoft.Web/sites/slotsswap/Action
  - Microsoft.Web/sites/slots/slotsswap/Action
  conditions:
  - service_state
  escalation: Stage malicious code on a low-privilege slot, then swap it into the production slot; the
    swapped-in code then runs under the production slot's managed identity (potential privilege gain with
    no direct rights on production).
  false_positive_note: Escalation only if the swap-target slot binds a managed identity that out-privileges
    the caller and the caller can stage code/config on the source slot. Slot settings marked as deployment
    (sticky) settings do NOT swap; a benign swap without staged code is not execution. Realized when the
    target slot is live -> CONDITIONAL(service_state).
  narrative: '{principal.name} can swap staged code from a controlled slot into swap-target {target.name}
    (slotsswap/Action), running attacker code under the target slot''s managed identity.'