azure-nsg-object-write

Principal with networkSecurityGroups/write can replace the full NSG rule set, including deleting all existing Deny rules - strictly stronger than securityRules/write alone.

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Network/networkSecurityGroups/write", "scope_type": "resource|resourceGroup|subscription" }

emit

source typeIdentity
target typeFirewall
source<principal>
target<NSG node (Firewall)>
permissionsMicrosoft.Network/networkSecurityGroups/write
conditionsiam_permission deny_assignment
state logicACTIVE if the principal's effective permission at the NSG scope includes networkSecurityGroups/write and no deny assignment covers it; BLOCKED if a deny assignment covers networkSecurityGroups/write at the NSG, RG, or subscription scope.

Narrative

{principal.name} can replace the full rule set of NSG {target.name} (Microsoft.Network/networkSecurityGroups/write), including removing existing Deny rules and inserting broad Allow rules.

Raw rule rules/derived/azure/nsg.yaml

id: azure-nsg-object-write
emits: CanModifyConfiguration
description: "Principal with networkSecurityGroups/write can replace the full NSG rule set, including\
  \ deleting all existing Deny rules \u2014 strictly stronger than securityRules/write alone."
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Network/networkSecurityGroups/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal>
  target: <NSG node (Firewall)>
  permissions:
  - Microsoft.Network/networkSecurityGroups/write
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE if the principal's effective permission at the NSG scope includes networkSecurityGroups/write
    and no deny assignment covers it; BLOCKED if a deny assignment covers networkSecurityGroups/write
    at the NSG, RG, or subscription scope.
  confidence: 0.97
  derived_from:
  - '<RBAC effective permission: networkSecurityGroups/write at NSG scope>'
  false_positive_note: "networkSecurityGroups/write allows creating or replacing the NSG object and its\
    \ complete rule set; it is a superset of securityRules/write. The effective permission evaluator should\
    \ emit only azure-nsg-object-write when the principal holds networkSecurityGroups/write at the NSG\
    \ scope, since this action subsumes securityRules/write. If the collector reports both action chains\
    \ separately, deduplication is the responsibility of the engine's effective-permission normalizer\
    \ (match_effective_permission handler), not this rule's where clause. Trust the engine to not emit\
    \ duplicate CanModifyConfiguration edges for the same (principal, NSG) pair when one permission subsumes\
    \ the other. A deny assignment blocking networkSecurityGroups/write \u2192 BLOCKED."
  narrative: '{principal.name} can replace the full rule set of NSG {target.name} (Microsoft.Network/networkSecurityGroups/write),
    including removing existing Deny rules and inserting broad Allow rules.'
move · open · esc close