rage.fail

azure-sub-deny-assignment

explicit azure emits HasPolicy

match (record)

{ "field": "id", "resource_type": "Microsoft.Authorization/denyAssignments" }

emit

source type	`*`
target type	`Policy`
source	`<scope node (subscription \| resourceGroup \| resource)>`
target	`<deny assignment ConditionalPolicy node>`

Narrative

{scope.name} has deny assignment {denyAssignment.name} denying {value} (guardrail - suppresses matching control edges)."

Raw rule rules/explicit/azure-subscriptions.yaml

id: azure-sub-deny-assignment
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.Authorization/denyAssignments
  field: id
emit:
  source_type: '*'
  target_type: Policy
  source: <scope node (subscription | resourceGroup | resource)>
  target: <deny assignment ConditionalPolicy node>
  api_source: GET /{scope}/providers/Microsoft.Authorization/denyAssignments
  evidence_field: properties.permissions.denyActions
  note: The deny assignment node is a Policy/ConditionalPolicy guardrail. Its properties.permissions[].denyActions,
    properties.principals, properties.excludePrincipals, properties.scope, and properties.doNotApplyToChildScopes
    determine WHICH inherited control edges it suppresses to BLOCKED. Deny assignments win over role assignments.
    Most are system-managed (isSystemProtected / created by Blueprints or Managed Apps).
  narrative: "{scope.name} has deny assignment {denyAssignment.name} denying {value} (guardrail \u2014\
    \ suppresses matching control edges).\""