rage.fail

azure-la-executes-as-user-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "identity.userAssignedIdentities", "resource_type": "Microsoft.Logic/workflows" }

where

identity.type in [UserAssigned, 'SystemAssigned, UserAssigned']

emit

source type	`Compute`
target type	`Identity`
source	`<Logic App workflow>`
target	`<each user-assigned MI listed in identity.userAssignedIdentities keys>`

Narrative

{workflow.name} runs as user-assigned managed identity {mi.name}.

Raw rule rules/explicit/azure-logicapps.yaml

id: azure-la-executes-as-user-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Microsoft.Logic/workflows
  field: identity.userAssignedIdentities
where:
- identity.type in [UserAssigned, 'SystemAssigned, UserAssigned']
emit:
  source_type: Compute
  target_type: Identity
  source: <Logic App workflow>
  target: <each user-assigned MI listed in identity.userAssignedIdentities keys>
  api_source: az rest --method GET --url .../providers/Microsoft.Logic/workflows/<name>
  evidence_field: identity.userAssignedIdentities (keys are resource IDs)
  note: Emit one ExecutesAs per user-assigned MI resource ID key.
  narrative: '{workflow.name} runs as user-assigned managed identity {mi.name}.'