azure-mi-federated-cred-trust-anchor

id: azure-mi-federated-cred-trust-anchor
emits: TrustsExternalIdentity
applies_to:
- azure
match_record:
  resource_type: Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials
  field: issuer
emit:
  source_type: ManagedIdentity
  target_type: FederatedIdentity
  source: <user-assigned MI that owns this federatedIdentityCredential>
  target: <ExternalIdentity / FederatedIdentity node representing the issuer+subject>
  api_source: az identity federated-credential list --identity-name <name> -g <rg>
  evidence_field: issuer, subject, audiences
  note: "The trust condition is carried as properties on this edge:\n  trust_condition.issuer   = federatedIdentityCredential.issuer\n\
    \  trust_condition.subject  = federatedIdentityCredential.subject (may be blank/broad)\n  trust_condition.audiences\
    \ = federatedIdentityCredential.audiences\nThe subject field determines ACTIVE vs CONDITIONAL per\
    \ federation-chains federation-maps-to-identity (unpinned/broad subject => ACTIVE, specific subject\
    \ => CONDITIONAL(trust_condition)). Well-known broad patterns:\n  GitHub Actions:   broad if `sub`\
    \ not scoped to repo:org/repo:ref:...\n  AKS WI:           broad if `sub` is just a namespace:SA pair\
    \ (widely achievable)\n  Azure Pipelines:  typically scoped (project+org); usually CONDITIONAL"
  narrative: Managed identity {mi.name} trusts external OIDC identity from issuer {issuer} with subject
    constraint '{subject}' and audience(s) {audiences}. An identity satisfying this condition can obtain
    a bearer token for {mi.name} without any on-host foothold.