rage.fail

azure-la-trigger-run-action

explicit azure emits CanInvoke

match (effective permission)

{ "action": "Microsoft.Logic/workflows/triggers/run/action", "scope_type": "resource|resourceGroup|subscription" }

emit

source type	`Identity`
target type	`Workflow`
source	`<principal>`
target	`<Logic App workflow>`
permissions	`Microsoft.Logic/workflows/triggers/run/action`
conditions	`network_reachability`

Narrative

{principal.name} can manually trigger Logic App {target.name} (Microsoft.Logic/workflows/triggers/run/action), driving its execution as its managed identity.

Raw rule rules/explicit/azure-logicapps.yaml

id: azure-la-trigger-run-action
emits: CanInvoke
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Logic/workflows/triggers/run/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <Logic App workflow>
  permissions:
  - Microsoft.Logic/workflows/triggers/run/action
  conditions:
  - network_reachability
  narrative: '{principal.name} can manually trigger Logic App {target.name} (Microsoft.Logic/workflows/triggers/run/action),
    driving its execution as its managed identity.'