azure-snapshot-admin
Wildcard permission on snapshots grants full control of the snapshot resource.
match (effective permission)
{
"action": "Microsoft.Compute/snapshots/*",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Snapshot |
| source | <principal> |
| target | <disk snapshot in scope> |
| permissions | Microsoft.Compute/snapshots/* |
Narrative
{principal.name} has full control of snapshot {target.name} (Microsoft.Compute/snapshots/*).
Raw rule rules/explicit/azure-disks.yaml
id: azure-snapshot-admin
emits: CanAdminister
description: Wildcard permission on snapshots grants full control of the snapshot resource.
match_effective_permission:
action: Microsoft.Compute/snapshots/*
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Snapshot
source: <principal>
target: <disk snapshot in scope>
permissions:
- Microsoft.Compute/snapshots/*
false_positive_note: Requires the Microsoft.Compute/snapshots/* wildcard. Roles granting only snapshots/beginGetAccess/action
(e.g. Disk Backup Reader) produce CanExfiltrate, not CanAdminister.
narrative: '{principal.name} has full control of snapshot {target.name} (Microsoft.Compute/snapshots/*).'