rage.fail

azure-mi-federated-cred-maps-to

explicit azure emits ExternalIdentityMapsTo

match (record)

{ "field": "subject", "resource_type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials" }

emit

source type	`FederatedIdentity`
target type	`ManagedIdentity`
source	`<ExternalIdentity / FederatedIdentity node for this issuer+subject>`
target	`<user-assigned MI>`

Narrative

External identity with issuer {issuer} and subject '{subject}' maps to managed identity {mi.name} via the federatedIdentityCredential trust. When the trust condition is satisfied, this external identity can obtain {mi.name}'s bearer token.

Raw rule rules/explicit/azure-managedidentity.yaml

id: azure-mi-federated-cred-maps-to
emits: ExternalIdentityMapsTo
applies_to:
- azure
match_record:
  resource_type: Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials
  field: subject
emit:
  source_type: FederatedIdentity
  target_type: ManagedIdentity
  source: <ExternalIdentity / FederatedIdentity node for this issuer+subject>
  target: <user-assigned MI>
  api_source: az identity federated-credential list
  evidence_field: issuer, subject
  note: Paired with azure-mi-federated-cred-trust-anchor. Together these two explicit edges provide the
    TrustsExternalIdentity + ExternalIdentityMapsTo pair that federation-chains.yaml (federation-maps-to-identity)
    collapses into CanFederateAs(?ext -> ?mi). The condition breadth on the subject field determines ACTIVE
    vs CONDITIONAL(trust_condition) per federation-chains rules.
  narrative: External identity with issuer {issuer} and subject '{subject}' maps to managed identity {mi.name}
    via the federatedIdentityCredential trust. When the trust condition is satisfied, this external identity
    can obtain {mi.name}'s bearer token.