azure-pl-dns-zone-write

Write access to a private DNS zone object (Microsoft.Network/privateDnsZones/write) grants full administrative control: the identity can replace, delete, or recreate the zone entirely. This is higher-impact than record-level write because it includes zone deletion (DoS) and recreation with attacker-controlled records. Zone write subsumes record write (the can-control linchpin derives Controls from this).

explicit azure emits CanAdminister

source type	`Identity`
target type	`DNS`
source	`<principal>`
target	`<private DNS zone>`
permissions	`Microsoft.Network/privateDnsZones/write`
state logic	ACTIVE

source type

Identity

target type

DNS

source

<principal>

target

<private DNS zone>

permissions

Microsoft.Network/privateDnsZones/write

state logic

ACTIVE

{principal.name} has full administrative control of private DNS zone {target.name} (Microsoft.Network/privateDnsZones/write), including the ability to replace, delete, or recreate the zone with attacker-controlled records.

Raw rule rules/explicit/azure-privatelink.yaml

id: azure-pl-dns-zone-write
emits: CanAdminister
description: 'Write access to a private DNS zone object (Microsoft.Network/privateDnsZones/write) grants
  full administrative control: the identity can replace, delete, or recreate the zone entirely. This is
  higher-impact than record-level write because it includes zone deletion (DoS) and recreation with attacker-controlled
  records. Zone write subsumes record write (the can-control linchpin derives Controls from this).'
match_effective_permission:
  action: Microsoft.Network/privateDnsZones/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: DNS
  source: <principal>
  target: <private DNS zone>
  permissions:
  - Microsoft.Network/privateDnsZones/write
  state_logic: ACTIVE
  derived_from:
  - '<effective permission record: privateDnsZones/write>'
  false_positive_note: CanAdminister on the zone grants full control but does NOT automatically grant
    Microsoft.Authorization/*/write (cannot assign RBAC directly on the zone). Zone deletion can cause
    DoS and requires recreation. CanAdminister -> Controls is derived by can-control.yaml (cited, not
    duplicated here). Deny assignments at the zone or RG scope block this -> BLOCKED.
  narrative: '{principal.name} has full administrative control of private DNS zone {target.name} (Microsoft.Network/privateDnsZones/write),
    including the ability to replace, delete, or recreate the zone with attacker-controlled records.'

azure-pl-dns-zone-write

match (effective permission)

emit

Narrative

Raw rule rules/explicit/azure-privatelink.yaml