rage.fail

azure-la-trigger-ip-allowlist

explicit azure emits HasPolicy

match (record)

{ "field": "properties.accessControl.triggers", "resource_type": "Microsoft.Logic/workflows" }

where

properties.accessControl.triggers.allowedCallerIpAddresses is present and non-empty

emit

source type	`*`
target type	`Policy`
source	`<Logic App workflow>`
target	`<trigger IP allowlist policy (GenericPolicy node)>`

Narrative

{workflow.name} has an HTTP trigger IP allowlist restricting callers to {policy.allowedRanges}.

Raw rule rules/explicit/azure-logicapps.yaml

id: azure-la-trigger-ip-allowlist
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.Logic/workflows
  field: properties.accessControl.triggers
where:
- properties.accessControl.triggers.allowedCallerIpAddresses is present and non-empty
emit:
  source_type: '*'
  target_type: Policy
  source: <Logic App workflow>
  target: <trigger IP allowlist policy (GenericPolicy node)>
  api_source: az rest --method GET --url .../providers/Microsoft.Logic/workflows/<name>
  evidence_field: properties.accessControl.triggers.allowedCallerIpAddresses
  narrative: '{workflow.name} has an HTTP trigger IP allowlist restricting callers to {policy.allowedRanges}.'