rage.fail

azure-sub-contains-resourcegroup

explicit azure emits Contains

match (record)

{ "field": "id", "resource_type": "Microsoft.Resources/subscriptions/resourceGroups" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<subscription node>`
target	`<resource group node>`

Narrative

{subscription.name} contains resource group {resourceGroup.name}.

Raw rule rules/explicit/azure-subscriptions.yaml

id: azure-sub-contains-resourcegroup
emits: Contains
applies_to:
- azure
match_record:
  resource_type: Microsoft.Resources/subscriptions/resourceGroups
  field: id
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <subscription node>
  target: <resource group node>
  api_source: GET /subscriptions/{id}/resourceGroups
  evidence_field: id
  narrative: '{subscription.name} contains resource group {resourceGroup.name}.'