azure-rediscache-arm-write-can-control

ARM write (redis/write) permission grants full control-plane administration: firewall rules, authentication settings, port configuration, managed identity, and deletion.

derived azure emits CanAdminister

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'cache': None}

where

node_type(?cache) == Cache ?cache.provider_type == 'Microsoft.Cache/redis' ?principal has EFFECTIVE Microsoft.Cache/redis/write at ?cache scope (Owner, Contributor, Redis Cache Contributor, or custom role with redis/write)

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?cache`
permissions	`Microsoft.Cache/redis/write`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy covers redis/write at the effective scope: BLOCKED; else ACTIVE. This is an ARM control-plane action; the Redis IP firewall and publicNetworkAccess settings do NOT gate it. The write permission covers all cache properties including redisConfiguration (authnotrequired, enableNonSslPort), firewallRules (via Microsoft.Cache/redis/firewallRules/write included in Contributor), and managed identity assignment. This CanControl edge is the canonical derived summary of master ARM control over the resource. Note: Contributor at the cache scope also includes listKeys/action — the separate azure-rediscache-listkeys-principal-read-credential rule captures that path directly.

Narrative

{principal.name} holds Microsoft.Cache/redis/write on {cache.name}, granting full control-plane administration: opening the firewall to the internet, disabling Redis authentication (authnotrequired), enabling the non-SSL port, retrieving access keys (listKeys), rotating keys, modifying the managed identity for CMK, or deleting the cache. This is the ARM master control over the resource.

Raw rule rules/derived/azure/rediscache.yaml

id: azure-rediscache-arm-write-can-control
emits: CanAdminister
description: 'ARM write (redis/write) permission grants full control-plane administration: firewall rules,
  authentication settings, port configuration, managed identity, and deletion.'
match:
- - principal: null
  - HasPermission
  - cache: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- ?principal has EFFECTIVE Microsoft.Cache/redis/write at ?cache scope (Owner, Contributor, Redis Cache
  Contributor, or custom role with redis/write)
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?cache
  permissions:
  - Microsoft.Cache/redis/write
  conditions:
  - iam_permission
  state_logic: "if a deny assignment or deny Azure Policy covers redis/write at the effective scope: BLOCKED;\
    \ else ACTIVE. This is an ARM control-plane action; the Redis IP firewall and publicNetworkAccess\
    \ settings do NOT gate it. The write permission covers all cache properties including redisConfiguration\
    \ (authnotrequired, enableNonSslPort), firewallRules (via Microsoft.Cache/redis/firewallRules/write\
    \ included in Contributor), and managed identity assignment. This CanControl edge is the canonical\
    \ derived summary of master ARM control over the resource. Note: Contributor at the cache scope also\
    \ includes listKeys/action \u2014 the separate azure-rediscache-listkeys-principal-read-credential\
    \ rule captures that path directly."
  confidence: '0.95'
  derived_from:
  - <HasPermission edge_id (redis/write)>
  false_positive_note: "The Redis Cache Contributor built-in role includes redis/write AND listKeys/action.\
    \ Redis Cache Contributor does NOT include Microsoft.Authorization/* (cannot grant permissions) \u2014\
    \ it is not an RBAC escalation path on its own. ARM Contributor and Owner at the subscription/RG/cache\
    \ scope DO include both redis/write and listKeys/action. Custom roles must explicitly list redis/write.\
    \ Do NOT emit CanControl for redis/read-only roles (e.g., Reader) \u2014 read access does NOT include\
    \ write or listKeys."
  narrative: '{principal.name} holds Microsoft.Cache/redis/write on {cache.name}, granting full control-plane
    administration: opening the firewall to the internet, disabling Redis authentication (authnotrequired),
    enabling the non-SSL port, retrieving access keys (listKeys), rotating keys, modifying the managed
    identity for CMK, or deleting the cache. This is the ARM master control over the resource.'