azure-nsg-admin

id: azure-nsg-admin
emits: CanAdminister
description: Principal with the networkSecurityGroups/* wildcard (Network Contributor, Contributor, Owner)
  has full administrative control over the NSG.
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Network/networkSecurityGroups/*
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal>
  target: <NSG node (Firewall)>
  permissions:
  - Microsoft.Network/networkSecurityGroups/*
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE if the principal's effective permission includes the networkSecurityGroups/* wildcard
    and no deny assignment at NSG/RG/subscription scope blocks networkSecurityGroups/write or higher.
    BLOCKED if a deny assignment covers networkSecurityGroups/write or networkSecurityGroups/* at the
    NSG, resource group, or subscription scope. A deny assignment covering only a subset like securityRules/delete
    does NOT block CanAdminister if networkSecurityGroups/write remains unblocked.
  confidence: 0.97
  derived_from:
  - '<RBAC effective permission: networkSecurityGroups/* at NSG scope>'
  - "can-control:control-via-admin  # derives Controls(principal \u2192 NSG)"
  false_positive_note: "CanAdminister requires the Microsoft.Network/networkSecurityGroups/* wildcard\
    \ \u2014 Network Contributor, Contributor, or Owner at a scope that covers the NSG. A custom role\
    \ granting only securityRules/write does NOT get CanAdminister; that is covered by azure-nsg-rule-write.\
    \ CanAdminister does NOT imply Microsoft.Authorization/*/write \u2014 assigning RBAC still requires\
    \ Owner or User Access Administrator. The can-control.yaml linchpin rule (control-via-admin) automatically\
    \ derives Controls(principal \u2192 NSG) from this CanAdminister edge for objective-query composition."
  narrative: '{principal.name} has full control of NSG {target.name} (Microsoft.Network/networkSecurityGroups/*)
    and can add, replace, or delete any security rule, or re-associate the NSG with any subnet or NIC.'