rage.fail

azure-mhsm-mgmt-admin

explicit azure emits CanAdminister

match (effective permission)

{ "action": "Microsoft.KeyVault/managedHSMs/write", "resource_type": "Microsoft.KeyVault/managedHSMs" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<Managed HSM pool node>`
permissions	`Microsoft.KeyVault/managedHSMs/write`

Narrative

{principal.name} controls the Managed HSM pool at the ARM layer (NOT data-plane key usage).

Raw rule rules/explicit/azure-managedhsm.yaml

id: azure-mhsm-mgmt-admin
emits: CanAdminister
applies_to:
- azure
match_effective_permission:
  action: Microsoft.KeyVault/managedHSMs/write
  resource_type: Microsoft.KeyVault/managedHSMs
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Managed HSM pool node>
  api_source: Azure RBAC role assignments (ARM)
  permissions:
  - Microsoft.KeyVault/managedHSMs/write
  false_positive_note: 'CRITICAL GUARD: this grants control of the ARM pool object (networking, purge
    protection, initiating security-domain recovery) but does NOT grant ANY data-plane key usage. Do NOT
    chain this to CanDecrypt/CanSignAs/ CanExportKey. A subscription Owner / Managed HSM Contributor is
    NOT a crypto operator on a Managed HSM. The only data-plane path from here is initiating security-domain
    recovery (derived azure-mhsm-security-domain-clone), which requires out-of-band SD custody. State:
    ACTIVE for management-plane control; BLOCKED if an Azure deny assignment denies managedHSMs/write
    at scope.'
  narrative: '{principal.name} controls the Managed HSM pool at the ARM layer (NOT data-plane key usage).'