rage.fail

azure-nsg-join-action

explicit azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Network/networkSecurityGroups/join/action", "resource_type": "Microsoft.Network/networkSecurityGroups" }

emit

source type	`Identity`
target type	`Firewall`
source	`<principal (Identity)>`
target	`<NSG node (Firewall)>`
permissions	`Microsoft.Network/networkSecurityGroups/join/action`

Narrative

{principal.name} can associate/re-associate NSG {target.name} with subnets or network interfaces (Microsoft.Network/networkSecurityGroups/join/action). Combined with controlling a permissive NSG, this enables replacing the target subnet's NSG, bypassing its existing firewall rules.

Raw rule rules/explicit/azure-nsg.yaml

id: azure-nsg-join-action
emits: CanModifyConfiguration
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Network/networkSecurityGroups/join/action
  resource_type: Microsoft.Network/networkSecurityGroups
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal (Identity)>
  target: <NSG node (Firewall)>
  permissions:
  - Microsoft.Network/networkSecurityGroups/join/action
  narrative: '{principal.name} can associate/re-associate NSG {target.name} with subnets or network interfaces
    (Microsoft.Network/networkSecurityGroups/join/action). Combined with controlling a permissive NSG,
    this enables replacing the target subnet''s NSG, bypassing its existing firewall rules.'