rage.fail

azure-mi-resource-node

explicit azure emits LocatedIn

match (record)

{ "field": "id", "resource_type": "Microsoft.ManagedIdentity/userAssignedIdentities" }

emit

source type	`ManagedIdentity`
target type	`AdministrativeBoundary`
source	`<managed identity node>`
target	`<resource group containing the MI>`

Narrative

{mi.name} (user-assigned managed identity) is located in resource group {rg.name}.

Raw rule rules/explicit/azure-managedidentity.yaml

id: azure-mi-resource-node
emits: LocatedIn
applies_to:
- azure
match_record:
  resource_type: Microsoft.ManagedIdentity/userAssignedIdentities
  field: id
emit:
  source_type: ManagedIdentity
  target_type: AdministrativeBoundary
  source: <managed identity node>
  target: <resource group containing the MI>
  api_source: az identity list / az identity show
  evidence_field: id
  narrative: '{mi.name} (user-assigned managed identity) is located in resource group {rg.name}.'