rage.fail

azure-kv-access-policy-artifact

explicit azure emits HasPolicy

match (record)

{ "field": "properties.accessPolicies", "resource_type": "Microsoft.KeyVault/vaults" }

where

properties.enableRbacAuthorization == false

emit

source type	`*`
target type	`Policy`
source	`<vault node>`
target	`<accessPolicies ResourcePolicy node>`

Narrative

{vault.name} uses the legacy access-policy model with {count} access-policy entries.

Raw rule rules/explicit/azure-keyvault.yaml

id: azure-kv-access-policy-artifact
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.KeyVault/vaults
  field: properties.accessPolicies
where:
- properties.enableRbacAuthorization == false
emit:
  source_type: '*'
  target_type: Policy
  source: <vault node>
  target: <accessPolicies ResourcePolicy node>
  api_source: Microsoft.KeyVault/vaults GET
  evidence_field: properties.accessPolicies
  narrative: '{vault.name} uses the legacy access-policy model with {count} access-policy entries.'