azure-la-std-config-write
Modify app settings/config of a Standard Logic App (WEBSITE_RUN_FROM_PACKAGE / image / env / identity).
match (effective permission)
{
"action": "Microsoft.Web/sites/config/Write",
"scope_type": "resource|resourceGroup|subscription"
}
where
target site has kind containing 'workflowapp' (Standard Logic App)
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Standard Logic App site> |
| permissions | Microsoft.Web/sites/config/Write |
| conditions | service_state |
| state logic | Realized at next restart/deploy; pair with trigger/invoke or CanStart for ACTIVE. CONDITIONAL(trigger_exists) absent. BLOCKED if deny assignment covers config/Write. |
Narrative
{principal.name} can rewrite app settings/config of Standard Logic App {target.name} (Microsoft.Web/sites/config/Write), enabling a package swap, image replacement, or environment variable injection that runs as its identity.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-std-config-write
emits: CanModifyConfiguration
description: Modify app settings/config of a Standard Logic App (WEBSITE_RUN_FROM_PACKAGE / image / env
/ identity).
match_effective_permission:
action: Microsoft.Web/sites/config/Write
scope_type: resource|resourceGroup|subscription
where:
- target site has kind containing 'workflowapp' (Standard Logic App)
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Standard Logic App site>
permissions:
- Microsoft.Web/sites/config/Write
conditions:
- service_state
state_logic: Realized at next restart/deploy; pair with trigger/invoke or CanStart for ACTIVE. CONDITIONAL(trigger_exists)
absent. BLOCKED if deny assignment covers config/Write.
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.Web/sites/config/Write'
false_positive_note: "Standard Logic Apps only. config/Write enables WEBSITE_RUN_FROM_PACKAGE swap,\
\ container image replacement, startup command injection, or MI identity block changes (when combined\
\ with sites/write). A benign setting change is not immediate execution \u2014 pair with a code-deploy\
\ or trigger path."
narrative: '{principal.name} can rewrite app settings/config of Standard Logic App {target.name} (Microsoft.Web/sites/config/Write),
enabling a package swap, image replacement, or environment variable injection that runs as its identity.'