azure-sf-execute-as-via-admin-client
Admin client cert -> provision app + the app runs as an MI => execute as that MI.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanModifyCode {'artifactRepo': None}
{'artifactRepo': None} AttachedTo {'cluster': None}
{'app': None} ExecutesAs {'mi': None}
where
?app is (or can be created) on ?cluster
?artifactRepo is the application type/version + image store (
ArtifactRepository) of ?cluster
?principal's CanModifyCode(?artifactRepo) is via the admin client cert (data plane)
?mi.privilege_level >= ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <managed identity> |
| permissions | FabricClient:CreateApplication FabricClient:ProvisionApplicationType |
| conditions | network_reachability service_state |
Narrative
{principal.name} can provision an application on the cluster via the admin client cert, binding MI {mi.name}, executing as {mi.name}.
Raw rule rules/derived/azure/servicefabric.yaml
id: azure-sf-execute-as-via-admin-client
emits: CanExecuteAs
description: Admin client cert -> provision app + the app runs as an MI => execute as that MI.
match:
- - principal: null
- CanModifyCode
- artifactRepo: null
- - artifactRepo: null
- AttachedTo
- cluster: null
- - app: null
- ExecutesAs
- mi: null
where:
- ?app is (or can be created) on ?cluster
- ?artifactRepo is the application type/version + image store (ArtifactRepository) of ?cluster
- ?principal's CanModifyCode(?artifactRepo) is via the admin client cert (data plane)
- ?mi.privilege_level >= ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <managed identity>
conditions:
- network_reachability
- service_state
permissions:
- FabricClient:CreateApplication
- FabricClient:ProvisionApplicationType
derived_from:
- <CanModifyCode(artifactRepo) edge_id>
- <AttachedTo edge_id>
- <ExecutesAs edge_id>
false_positive_note: 'Data-plane path: requires the admin client cert AND network reach to 19000/19080.
The app must bind an MI that out-privileges the caller. Do not emit from ARM RBAC alone. The CanModifyCode
edge targets the ArtifactRepository (image store) AttachedTo the cluster, matching azure-sf-admin-client-provision''s
schema-conformant target.'
narrative: '{principal.name} can provision an application on the cluster via the admin client cert,
binding MI {mi.name}, executing as {mi.name}.'