rage.fail

azure-mhsm-can-grant-role

explicit azure emits CanGrantPermission

match (effective permission)

{ "action": "Microsoft.KeyVault/managedHsm/roleAssignments/write/action", "resource_type": "Microsoft.KeyVault/managedHSMs" }

where

effective grant is a Managed HSM LOCAL role dataAction carrying roleAssignments/write/action (Managed HSM Administrator, Crypto Officer, OR Policy Administrator — match on the data action, not a single role name)

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<principal>`
permissions	`Microsoft.KeyVault/managedHsm/roleAssignments/write/action`

Narrative

{principal.name} holds a Managed HSM local role with roleAssignments/write (Administrator, Crypto Officer, or Policy Administrator) and can grant local roles (incl. to itself).

Raw rule rules/explicit/azure-managedhsm.yaml

id: azure-mhsm-can-grant-role
emits: CanGrantPermission
applies_to:
- azure
match_effective_permission:
  action: Microsoft.KeyVault/managedHsm/roleAssignments/write/action
  resource_type: Microsoft.KeyVault/managedHSMs
where:
- "effective grant is a Managed HSM LOCAL role dataAction carrying roleAssignments/write/action (Managed\
  \ HSM Administrator, Crypto Officer, OR Policy Administrator \u2014 match on the data action, not a\
  \ single role name)"
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <principal>
  api_source: GET {hsm}/RoleAssignments + roleDefinition dataActions
  permissions:
  - Microsoft.KeyVault/managedHsm/roleAssignments/write/action
  narrative: '{principal.name} holds a Managed HSM local role with roleAssignments/write (Administrator,
    Crypto Officer, or Policy Administrator) and can grant local roles (incl. to itself).'