rage.fail

azure-mg-contains-subscription

explicit azure emits Contains

match (record)

{ "field": "properties.children[].type == /subscriptions", "resource_type": "Microsoft.Management/managementGroups" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<management group node>`
target	`<subscription node>`

Narrative

{mg.name} contains subscription {subscription.name}.

Raw rule rules/explicit/azure-mgmtgroups.yaml

id: azure-mg-contains-subscription
emits: Contains
applies_to:
- azure
match_record:
  resource_type: Microsoft.Management/managementGroups
  field: properties.children[].type == /subscriptions
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <management group node>
  target: <subscription node>
  api_source: Microsoft.Management/managementGroups GET ?$expand=children | getEntities
  evidence_field: properties.children[].id
  note: "The managementGroups/subscriptions association. New subscriptions default under the root MG.\
    \ Contains is walkable:false \u2014 hierarchy-chains.yaml admin-inherits-down-contains performs the\
    \ traversable descent."
  narrative: '{mg.name} contains subscription {subscription.name}.'