azure-policy-trigger-remediation

id: azure-policy-trigger-remediation
emits: CanTrigger
description: Explicitly trigger a policy remediation task via Microsoft.PolicyInsights/remediations/write;
  the remediation executes as the assignment's bound MI. This is a direct trigger path that does not require
  policyAssignments/write if the assignment already has a remediation MI configured.
match_effective_permission:
  action: Microsoft.PolicyInsights/remediations/write
  scope_type: resource|resourceGroup|subscription|managementGroup
where:
- principal effectively holds Microsoft.PolicyInsights/remediations/write at the scope
- at least one policy assignment in scope has an identity block with deployIfNotExists or modify effect
  (ExecutesAs confirmed by azure-policy-remediation-task-executes-as-mi)
emit:
  source_type: Identity
  target_type: BuildWorker
  source: <principal>
  target: <remediation task (BuildWorker) for the targeted assignment>
  permissions:
  - Microsoft.PolicyInsights/remediations/write
  conditions:
  - service_state
  state_logic: ACTIVE when the principal holds remediations/write AND a remediation-eligible assignment
    exists at that scope (assignment has identity + deployIfNotExists/modify effect). CONDITIONAL(service_state)
    if the policy service is not evaluating (unlikely for standard assignments; more relevant for paused/disabled
    assignments). BLOCKED if a deny assignment covers remediations/write. cicd-chains cicd-trigger-runner-executes-as
    keeps this CONDITIONAL(attacker_influenced_definition) unless the remediation task already runs attacker-controlled
    content (which for policy remediations means the underlying deployIfNotExists template is attacker-authored).
    When paired with azure-policy-assignment-write-deploy-effect (CanModifyConfiguration), the combined
    path is the MODIFY variant (ACTIVE). When remediations/write is held without policyAssignments/write,
    this is the weaker trigger-only path.
  confidence: 0.88
  derived_from:
  - 'effective permission: Microsoft.PolicyInsights/remediations/write'
  - 'cicd-chains.yaml: cicd-trigger-runner-executes-as (rule 2, CONDITIONAL unless definition is attacker-influenced)'
  - 'can-execute-as.yaml: execute-as-via-command (if remediation triggers OS-level ops)'
  false_positive_note: "remediations/write alone triggers the CURRENT remediation definition (the policy's\
    \ deployIfNotExists ARM template or modify effect). This yields the MI's token only if (a) the attacker\
    \ can influence the ARM template content (via policyAssignments/write or policyDefinitions/write \u2014\
    \ then use the MODIFY path, not this trigger-only rule) or (b) the remediation task already performs\
    \ actions the attacker benefits from (e.g., the existing template grants a role assignment, creates\
    \ a resource, or runs a script). For a trusted, unmodified remediation template the attacker cannot\
    \ influence, keep CONDITIONAL(attacker_influenced_definition). Do not emit for assignments with Deny/Audit\
    \ effects that have no remediation task."
  narrative: '{principal.name} can explicitly trigger a policy remediation task (Microsoft.PolicyInsights/remediations/write);
    the task executes as the assignment''s bound managed identity {mi.name}. cicd-chains derives CanExecuteAs
    CONDITIONAL(attacker_influenced_definition) from this trigger + the ExecutesAs fact.'