azure-policy-assignment-executes-as-system-mi
A policy assignment with a system-assigned managed identity produces an ExecutesAs edge: remediation tasks run as that system MI. Extracted from the assignment's identity.principalId field.
match (record)
{
"field": "identity",
"resource_type": "Microsoft.Authorization/policyAssignments"
}
where
identity.type in [SystemAssigned, 'SystemAssigned, UserAssigned']
properties.policyDefinitionId references a definition with deployIfNotExists or modify effect
emit
| source type | BuildWorker |
|---|---|
| target type | ManagedIdentity |
| source | <remediation task for the policy assignment> |
| target | <system-assigned MI (identity.principalId)> |
Narrative
Policy assignment {assignment.name} remediation tasks run as system-assigned MI {target.name} (identity.principalId).
Raw rule rules/explicit/azure-policy.yaml
id: azure-policy-assignment-executes-as-system-mi
emits: ExecutesAs
applies_to:
- azure
description: 'A policy assignment with a system-assigned managed identity produces an ExecutesAs edge:
remediation tasks run as that system MI. Extracted from the assignment''s identity.principalId field.'
match_record:
resource_type: Microsoft.Authorization/policyAssignments
field: identity
where:
- identity.type in [SystemAssigned, 'SystemAssigned, UserAssigned']
- properties.policyDefinitionId references a definition with deployIfNotExists or modify effect
emit:
source_type: BuildWorker
target_type: ManagedIdentity
source: <remediation task for the policy assignment>
target: <system-assigned MI (identity.principalId)>
api_source: GET /subscriptions/{sub}/providers/Microsoft.Authorization/policyAssignments
evidence_field: identity.principalId
nature: explicit
confidence: 1.0
narrative: Policy assignment {assignment.name} remediation tasks run as system-assigned MI {target.name}
(identity.principalId).