rage.fail

azure-rg-contains-resource

explicit azure emits Contains

match (record)

{ "field": "id", "resource_type": "Microsoft.Resources/resources" }

where

resource id has prefix /subscriptions/{s}/resourceGroups/{rg}/providers/...

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<resource group node (from id prefix)>`
target	`<resource node>`

Narrative

{resourceGroup.name} contains resource {resource.name}.

Raw rule rules/explicit/azure-subscriptions.yaml

id: azure-rg-contains-resource
emits: Contains
applies_to:
- azure
match_record:
  resource_type: Microsoft.Resources/resources
  field: id
where:
- resource id has prefix /subscriptions/{s}/resourceGroups/{rg}/providers/...
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <resource group node (from id prefix)>
  target: <resource node>
  api_source: GET /subscriptions/{id}/resources OR GET /subscriptions/{id}/resourceGroups/{rg}/resources
  evidence_field: id
  note: Parse the RG from the resource id prefix. Emit only if the owning service adapter has not already
    produced the Contains edge; dedupe on (Contains, rg, resource).
  narrative: '{resourceGroup.name} contains resource {resource.name}.'