rage.fail

azure-mi-system-assigned-executes-as

explicit azure emits ExecutesAs

match (record)

{ "field": "identity.type", "resource_type": "*", "value_contains": "SystemAssigned" }

emit

source type	`Compute`
target type	`ManagedIdentity`
source	`<host compute resource>`
target	`<system-assigned MI principal (identity.principalId on the host)>`

Narrative

{host.name} runs as its system-assigned managed identity (principalId: {identity.principalId}).

Raw rule rules/explicit/azure-managedidentity.yaml

id: azure-mi-system-assigned-executes-as
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: '*'
  field: identity.type
  value_contains: SystemAssigned
emit:
  source_type: Compute
  target_type: ManagedIdentity
  source: <host compute resource>
  target: <system-assigned MI principal (identity.principalId on the host)>
  api_source: ARM resource GET (identity block)
  evidence_field: identity.principalId
  narrative: '{host.name} runs as its system-assigned managed identity (principalId: {identity.principalId}).'