azure-la-workflow-write-modifycode
Overwrite the Logic App workflow definition to inject arbitrary actions running as the workflow's MI.
match (effective permission)
{
"action": "Microsoft.Logic/workflows/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Logic App workflow (Workflow node)> |
| permissions | Microsoft.Logic/workflows/write |
| conditions | trigger_exists service_state |
| state logic | ACTIVE when the definition is modified AND a trigger path exists (HTTP callback, recurrence, or an event-source binding is ENABLED). CONDITIONAL (trigger_exists) if no confirmed trigger or confirmed CanInvoke path exists (the workflow fires only on the next trigger event). BLOCKED if a deny assignment covers workflows/write. |
Narrative
{principal.name} can overwrite the workflow definition of Logic App {target.name} (Microsoft.Logic/workflows/write), injecting HTTP actions or inline code that runs as the workflow's managed identity on the next trigger.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-workflow-write-modifycode
emits: CanModifyCode
description: Overwrite the Logic App workflow definition to inject arbitrary actions running as the workflow's
MI.
match_effective_permission:
action: Microsoft.Logic/workflows/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Logic App workflow (Workflow node)>
permissions:
- Microsoft.Logic/workflows/write
conditions:
- trigger_exists
- service_state
state_logic: ACTIVE when the definition is modified AND a trigger path exists (HTTP callback, recurrence,
or an event-source binding is ENABLED). CONDITIONAL (trigger_exists) if no confirmed trigger or confirmed
CanInvoke path exists (the workflow fires only on the next trigger event). BLOCKED if a deny assignment
covers workflows/write.
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.Logic/workflows/write'
false_positive_note: "workflows/write is granted to Logic App Contributor, Contributor, and Owner roles.\
\ The Logic App Operator role does NOT have this permission; do not derive CanModifyCode from Operator\
\ role alone. Realized on next trigger \u2014 without a live trigger path, emit CONDITIONAL(trigger_exists)\
\ not ACTIVE. The managed identity must exist for CanExecuteAs to fire downstream; if the workflow\
\ has no MI, this yields only API-connection-credential access via ExposesCredential (handled by credential-chains),\
\ not ARM token access."
narrative: '{principal.name} can overwrite the workflow definition of Logic App {target.name} (Microsoft.Logic/workflows/write),
injecting HTTP actions or inline code that runs as the workflow''s managed identity on the next trigger.'