rage.fail

azure-la-executes-as-system-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "identity", "resource_type": "Microsoft.Logic/workflows" }

where

identity.type in [SystemAssigned, 'SystemAssigned, UserAssigned'] identity.principalId is present and non-empty

emit

source type	`Compute`
target type	`Identity`
source	`<Logic App workflow>`
target	`<system-assigned managed identity (Entra SP at identity.principalId)>`

Narrative

{workflow.name} runs as its system-assigned managed identity (principalId: {identity.principalId}).

Raw rule rules/explicit/azure-logicapps.yaml

id: azure-la-executes-as-system-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Microsoft.Logic/workflows
  field: identity
where:
- identity.type in [SystemAssigned, 'SystemAssigned, UserAssigned']
- identity.principalId is present and non-empty
emit:
  source_type: Compute
  target_type: Identity
  source: <Logic App workflow>
  target: <system-assigned managed identity (Entra SP at identity.principalId)>
  api_source: az rest --method GET --url .../providers/Microsoft.Logic/workflows/<name>
  evidence_field: identity.principalId
  narrative: '{workflow.name} runs as its system-assigned managed identity (principalId: {identity.principalId}).'