azure-lb-admin
Holding the Microsoft.Network/loadBalancers/* wildcard grants full control of a Standard Load Balancer.
match (effective permission)
{
"action": "Microsoft.Network/loadBalancers/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Microsoft.Network/loadBalancers/* (Network Contributor / Contributor / Owner) — not merely .../loadBalancers/read
emit
| source type | Identity |
|---|---|
| target type | LoadBalancer |
| source | <principal> |
| target | <Microsoft.Network/loadBalancers in scope> |
| permissions | Microsoft.Network/loadBalancers/write Microsoft.Network/loadBalancers/delete |
Narrative
{principal.name} has full administrative control of load balancer {target.name} (Microsoft.Network/loadBalancers/write wildcard), including modifying frontend IPs, backend pools, and load-balancing rules.
Raw rule rules/derived/azure/loadbalancer.yaml
id: azure-lb-admin
emits: CanAdminister
description: Holding the Microsoft.Network/loadBalancers/* wildcard grants full control of a Standard
Load Balancer.
match_effective_permission:
action: Microsoft.Network/loadBalancers/write
scope_type: resource|resourceGroup|subscription
where:
- "principal effectively holds Microsoft.Network/loadBalancers/* (Network Contributor / Contributor /\
\ Owner) \u2014 not merely .../loadBalancers/read"
emit:
source_type: Identity
target_type: LoadBalancer
source: <principal>
target: <Microsoft.Network/loadBalancers in scope>
permissions:
- Microsoft.Network/loadBalancers/write
- Microsoft.Network/loadBalancers/delete
false_positive_note: CanAdminister requires the write wildcard. A read-only role with only Microsoft.Network/loadBalancers/read
does NOT get CanAdminister. Network Contributor grants Microsoft.Network/* and qualifies. Reader does
not. The wildcard does NOT include Microsoft.Authorization/*/write; RBAC escalation requires a separate
permission.
narrative: '{principal.name} has full administrative control of load balancer {target.name} (Microsoft.Network/loadBalancers/write
wildcard), including modifying frontend IPs, backend pools, and load-balancing rules.'