rage.fail

azure-lighthouse-assignment-policy

explicit azure emits HasPolicy

match (record)

{ "field": "id", "resource_type": "Microsoft.ManagedServices/registrationAssignments" }

where

properties.provisioningState in ['Succeeded', 'Creating', 'Updating']

emit

source type	`AdministrativeBoundary`
target type	`Policy`
source	`<scope node — Subscription or ResourceGroup parsed from registrationAssignment id prefix>`
target	`<registrationAssignment node (ResourcePolicy type)>`

Narrative

{scope.name} has Lighthouse registrationAssignment {assignment.name} (provisioningState: {value}) pointing to managing tenant {definition.managingTenantId}.

Raw rule rules/explicit/azure-lighthouse.yaml

id: azure-lighthouse-assignment-policy
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.ManagedServices/registrationAssignments
  field: id
where:
- properties.provisioningState in ['Succeeded', 'Creating', 'Updating']
emit:
  source_type: AdministrativeBoundary
  target_type: Policy
  source: "<scope node \u2014 Subscription or ResourceGroup parsed from registrationAssignment id prefix>"
  target: <registrationAssignment node (ResourcePolicy type)>
  api_source: GET /subscriptions/{subId}/providers/Microsoft.ManagedServices/registrationAssignments?$expand=registrationDefinition
  evidence_field: id, properties.registrationDefinitionId, properties.provisioningState, properties.registrationDefinition.properties.managingTenantId
  note: "Scope is parsed from the registrationAssignment id:\n  /subscriptions/{guid}/providers/... ->\
    \ Subscription scope\n  /subscriptions/{guid}/resourceGroups/{rg}/providers/... -> ResourceGroup scope\n\
    The registrationAssignment carries the expanded registrationDefinition inline when ?$expand=registrationDefinition\
    \ is used; store managingTenantId and authorizations[] on the assignment node properties for downstream\
    \ rules. Set node state = provisioningState on the registrationAssignment node."
  narrative: '{scope.name} has Lighthouse registrationAssignment {assignment.name} (provisioningState:
    {value}) pointing to managing tenant {definition.managingTenantId}.'