azure-role-assignment-write
match (effective permission)
{
"action": "Microsoft.Authorization/roleAssignments/write",
"scope_type": "mg|subscription|resourceGroup|resource"
}
where
principal effectively holds Owner or User Access Administrator (or custom role with this action) at the scope
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <scope (mg/subscription/rg/resource)> |
| permissions | Microsoft.Authorization/roleAssignments/write |
Narrative
{principal.name} can create role assignments at {scope.name} (Owner/User Access Administrator) and grant itself Owner.
Raw rule rules/derived/azure/identity-escalation.yaml
id: azure-role-assignment-write
emits: CanGrantPermission
match_effective_permission:
action: Microsoft.Authorization/roleAssignments/write
scope_type: mg|subscription|resourceGroup|resource
where:
- principal effectively holds Owner or User Access Administrator (or custom role with this action) at
the scope
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <scope (mg/subscription/rg/resource)>
permissions:
- Microsoft.Authorization/roleAssignments/write
escalation: Assign Owner to self at the scope -> full control of everything under it.
cross_boundary: at subscription scope -> Controls(subscription) via can-control roll-up
false_positive_note: Contributor does NOT include roleAssignments/write; only Owner and User Access
Administrator (and custom roles explicitly granting it) qualify.
narrative: '{principal.name} can create role assignments at {scope.name} (Owner/User Access Administrator)
and grant itself Owner.'