azure-sf-app-pass-user-mi
Azure PassRole analog for the SF application plane: assign/action on a user-assigned MI lets the principal pass that MI to a workload.
match (effective permission)
{
"action": "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
"scope_type": "resource"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/assign/action |
| conditions | iam_permission role_compatibility |
Narrative
{principal.name} can pass user-assigned MI {target.name} to an SF workload (userAssignedIdentities/assign/action).
Raw rule rules/derived/azure/servicefabric.yaml
id: azure-sf-app-pass-user-mi
emits: CanPassIdentity
description: 'Azure PassRole analog for the SF application plane: assign/action on a user-assigned MI
lets the principal pass that MI to a workload.'
match_effective_permission:
action: Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
scope_type: resource
emit:
source_type: Identity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
conditions:
- iam_permission
- role_compatibility
false_positive_note: assign/action alone only grants the ability to PASS the MI; it does not attach
it to any resource without a resource write (e.g. applications/write). Honor the assign/action resource
scope.
narrative: '{principal.name} can pass user-assigned MI {target.name} to an SF workload (userAssignedIdentities/assign/action).'