azure-policy-assignment-executes-as-user-mi
A policy assignment with one or more user-assigned managed identities produces ExecutesAs edges for each. Extracted from the assignment's identity.userAssignedIdentities map (keys are MI resource IDs).
match (record)
{
"field": "identity.userAssignedIdentities",
"resource_type": "Microsoft.Authorization/policyAssignments"
}
where
identity.type == UserAssigned OR identity.type == 'SystemAssigned, UserAssigned'
identity.userAssignedIdentities is non-empty
properties.policyDefinitionId references a definition with deployIfNotExists or modify effect
emit
| source type | BuildWorker |
|---|---|
| target type | ManagedIdentity |
| source | <remediation task for the policy assignment> |
| target | <user-assigned MI (key in userAssignedIdentities map)> |
Narrative
Policy assignment {assignment.name} remediation tasks run as user-assigned MI {target.name}.
Raw rule rules/explicit/azure-policy.yaml
id: azure-policy-assignment-executes-as-user-mi
emits: ExecutesAs
applies_to:
- azure
description: A policy assignment with one or more user-assigned managed identities produces ExecutesAs
edges for each. Extracted from the assignment's identity.userAssignedIdentities map (keys are MI resource
IDs).
match_record:
resource_type: Microsoft.Authorization/policyAssignments
field: identity.userAssignedIdentities
where:
- identity.type == UserAssigned OR identity.type == 'SystemAssigned, UserAssigned'
- identity.userAssignedIdentities is non-empty
- properties.policyDefinitionId references a definition with deployIfNotExists or modify effect
emit:
source_type: BuildWorker
target_type: ManagedIdentity
source: <remediation task for the policy assignment>
target: <user-assigned MI (key in userAssignedIdentities map)>
api_source: GET /subscriptions/{sub}/providers/Microsoft.Authorization/policyAssignments
evidence_field: identity.userAssignedIdentities
nature: explicit
confidence: 1.0
narrative: Policy assignment {assignment.name} remediation tasks run as user-assigned MI {target.name}.