azure-nsg-object-write
Principal with networkSecurityGroups/write can replace the full NSG rule set, including deleting all existing Deny rules - strictly stronger than securityRules/write alone.
match (effective permission)
{
"action": "Microsoft.Network/networkSecurityGroups/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <NSG node (Firewall)> |
| permissions | Microsoft.Network/networkSecurityGroups/write |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE if the principal's effective permission at the NSG scope includes networkSecurityGroups/write and no deny assignment covers it; BLOCKED if a deny assignment covers networkSecurityGroups/write at the NSG, RG, or subscription scope. |
Narrative
{principal.name} can replace the full rule set of NSG {target.name} (Microsoft.Network/networkSecurityGroups/write), including removing existing Deny rules and inserting broad Allow rules.
Raw rule rules/derived/azure/nsg.yaml
id: azure-nsg-object-write
emits: CanModifyConfiguration
description: "Principal with networkSecurityGroups/write can replace the full NSG rule set, including\
\ deleting all existing Deny rules \u2014 strictly stronger than securityRules/write alone."
applies_to:
- azure
match_effective_permission:
action: Microsoft.Network/networkSecurityGroups/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <NSG node (Firewall)>
permissions:
- Microsoft.Network/networkSecurityGroups/write
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE if the principal's effective permission at the NSG scope includes networkSecurityGroups/write
and no deny assignment covers it; BLOCKED if a deny assignment covers networkSecurityGroups/write
at the NSG, RG, or subscription scope.
confidence: 0.97
derived_from:
- '<RBAC effective permission: networkSecurityGroups/write at NSG scope>'
false_positive_note: "networkSecurityGroups/write allows creating or replacing the NSG object and its\
\ complete rule set; it is a superset of securityRules/write. The effective permission evaluator should\
\ emit only azure-nsg-object-write when the principal holds networkSecurityGroups/write at the NSG\
\ scope, since this action subsumes securityRules/write. If the collector reports both action chains\
\ separately, deduplication is the responsibility of the engine's effective-permission normalizer\
\ (match_effective_permission handler), not this rule's where clause. Trust the engine to not emit\
\ duplicate CanModifyConfiguration edges for the same (principal, NSG) pair when one permission subsumes\
\ the other. A deny assignment blocking networkSecurityGroups/write \u2192 BLOCKED."
narrative: '{principal.name} can replace the full rule set of NSG {target.name} (Microsoft.Network/networkSecurityGroups/write),
including removing existing Deny rules and inserting broad Allow rules.'