rage.fail

azure-mi-user-assigned-executes-as

explicit azure emits ExecutesAs

match (record)

{ "field": "identity.userAssignedIdentities", "resource_type": "*" }

emit

source type	`Compute`
target type	`ManagedIdentity`
source	`<host compute resource>`
target	`<each user-assigned MI in identity.userAssignedIdentities (keyed by MI resource id)>`

Narrative

{host.name} runs as user-assigned managed identity {mi.name}.

Raw rule rules/explicit/azure-managedidentity.yaml

id: azure-mi-user-assigned-executes-as
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: '*'
  field: identity.userAssignedIdentities
emit:
  source_type: Compute
  target_type: ManagedIdentity
  source: <host compute resource>
  target: <each user-assigned MI in identity.userAssignedIdentities (keyed by MI resource id)>
  api_source: ARM resource GET (identity.userAssignedIdentities)
  evidence_field: identity.userAssignedIdentities
  note: Each key in identity.userAssignedIdentities is the full ARM resource ID of a user-assigned MI.
    Resolve to the MI node; the associated clientId / principalId are nested values in the map entry.
    Emit one ExecutesAs edge per MI.
  narrative: '{host.name} runs as user-assigned managed identity {mi.name}.'