azure-nsg-rule-write

id: azure-nsg-rule-write
emits: CanModifyConfiguration
description: Principal with securityRules/write can add an inbound Allow rule for Internet/0.0.0.0/0,
  opening previously blocked ports across all subnets and NICs where this NSG is associated.
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Network/networkSecurityGroups/securityRules/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal>
  target: <NSG node (Firewall)>
  permissions:
  - Microsoft.Network/networkSecurityGroups/securityRules/write
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE if the principal's effective permission at the NSG scope includes securityRules/write
    and no deny assignment covers it; BLOCKED if a deny assignment covers securityRules/write at the NSG,
    RG, or subscription scope.
  confidence: 0.95
  derived_from:
  - '<RBAC effective permission: securityRules/write at NSG scope>'
  false_positive_note: "Verify effective permissions (not just role assignments): a deny assignment at\
    \ the NSG, resource group, or subscription scope covering securityRules/write blocks this capability\
    \ \u2192 emit BLOCKED. The Security Admin built-in role includes this action; custom roles may grant\
    \ it alone. Scope must reach the specific NSG (or its parent RG/sub). This rule captures only the\
    \ write-to-open-rules capability; it does NOT directly create ExposedToInternet \u2014 that requires\
    \ the NSG to be associated with a subnet/NIC hosting a resource with a public IP (see azure-nsg-internet-exposed)."
  narrative: '{principal.name} can add an inbound Allow rule to NSG {target.name} (Microsoft.Network/networkSecurityGroups/securityRules/write),
    opening previously blocked ports across all associated subnets and NICs.'