rage.fail

azure-stack-executes-as

explicit azure emits ExecutesAs

match (effective permission)

{ "action": [ "read" ], "field": "identity.type", "resource_type": "Microsoft.Resources/deploymentStacks" }

where

identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned']

emit

source type	`BuildWorker`
target type	`ManagedIdentity`
source	`<deployment stack>`
target	`<managed identity (system-assigned principalId or user-assigned keys from identity.userAssignedIdentities)>`

Narrative

Deployment Stack {stack.name} executes as managed identity {mi.name} (type: {identity.type}).

Raw rule rules/explicit/azure-blueprints.yaml

id: azure-stack-executes-as
emits: ExecutesAs
applies_to:
- azure
match_effective_permission:
  action:
  - read
  resource_type: Microsoft.Resources/deploymentStacks
  field: identity.type
where:
- identity.type in [SystemAssigned, UserAssigned, 'SystemAssigned, UserAssigned']
emit:
  source_type: BuildWorker
  target_type: ManagedIdentity
  source: <deployment stack>
  target: <managed identity (system-assigned principalId or user-assigned keys from identity.userAssignedIdentities)>
  conditions: []
  api_source: 'Azure ARM: Microsoft.Resources/deploymentStacks GET (identity block)'
  narrative: 'Deployment Stack {stack.name} executes as managed identity {mi.name} (type: {identity.type}).'