rage.fail

azure-mhsm-local-role-assignment

explicit azure emits HasPolicy

match (record)

{ "field": "properties.principalId", "resource_type": "Microsoft.KeyVault/managedHsm/roleAssignments" }

emit

source type	`*`
target type	`Policy`
source	`<principal (properties.principalId)>`
target	`<local role assignment node (Policy)>`

Narrative

{principal.name} holds Managed HSM local role {roleDefinition.name} at scope {scope}.

Raw rule rules/explicit/azure-managedhsm.yaml

id: azure-mhsm-local-role-assignment
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.KeyVault/managedHsm/roleAssignments
  field: properties.principalId
emit:
  source_type: '*'
  target_type: Policy
  source: <principal (properties.principalId)>
  target: <local role assignment node (Policy)>
  api_source: GET {hsm}/RoleAssignments
  evidence_field: properties.roleDefinitionId + properties.scope
  narrative: '{principal.name} holds Managed HSM local role {roleDefinition.name} at scope {scope}.'