rage.fail

azure-mi-user-assigned-attached-to

explicit azure emits AttachedTo

match (record)

{ "field": "identity.userAssignedIdentities", "resource_type": "*" }

emit

source type	`ManagedIdentity`
target type	`Compute`
source	`<user-assigned MI (resolved from identity.userAssignedIdentities key)>`
target	`<host compute resource>`

Narrative

User-assigned MI {mi.name} is attached to {host.name}.

Raw rule rules/explicit/azure-managedidentity.yaml

id: azure-mi-user-assigned-attached-to
emits: AttachedTo
applies_to:
- azure
match_record:
  resource_type: '*'
  field: identity.userAssignedIdentities
emit:
  source_type: ManagedIdentity
  target_type: Compute
  source: <user-assigned MI (resolved from identity.userAssignedIdentities key)>
  target: <host compute resource>
  api_source: ARM resource GET (identity.userAssignedIdentities)
  evidence_field: identity.userAssignedIdentities
  note: 'AttachedTo is structural (walkable:false). One edge per (MI, host) pair. Used for reverse queries:
    ''which hosts share this MI?'' This surfaces shared blast radius in the UI.'
  narrative: User-assigned MI {mi.name} is attached to {host.name}.