azure-snapshot-write-policy
snapshots/write allows setting publicNetworkAccess and networkAccessPolicy on a snapshot, enabling cross-subscription SAS download.
match (effective permission)
{
"action": "Microsoft.Compute/snapshots/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Snapshot |
| source | <principal> |
| target | <disk snapshot> |
| permissions | Microsoft.Compute/snapshots/write |
| state logic | ACTIVE |
Narrative
{principal.name} can modify snapshot {target.name} (snapshots/write), including enabling public network access to facilitate cross-subscription SAS download.
Raw rule rules/explicit/azure-disks.yaml
id: azure-snapshot-write-policy
emits: CanModify
description: snapshots/write allows setting publicNetworkAccess and networkAccessPolicy on a snapshot,
enabling cross-subscription SAS download.
match_effective_permission:
action: Microsoft.Compute/snapshots/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Snapshot
source: <principal>
target: <disk snapshot>
permissions:
- Microsoft.Compute/snapshots/write
state_logic: ACTIVE
false_positive_note: "snapshots/write enables publicNetworkAccess: Enabled on an existing snapshot,\
\ which is the precursor to azure-snapshot-cross-sub-public. The CanModify edge here chains to CrossAccountTrust\
\ only after the policy is actually changed (or can be changed) \u2014 model as a two-step: CanModify\
\ -> [policy update] -> CrossAccountTrust(snapshot -> external sub). Emit CanModify as ACTIVE; the\
\ downstream CrossAccountTrust edge is POTENTIAL until the policy is confirmed changed."
narrative: '{principal.name} can modify snapshot {target.name} (snapshots/write), including enabling
public network access to facilitate cross-subscription SAS download.'