rage.fail

azure-sub-deny-policy-assignment

explicit azure emits HasPolicy

match (record)

{ "field": "id", "resource_type": "Microsoft.Authorization/policyAssignments" }

where

referenced policy definition effect in ['deny','denyAction']

emit

source type	`*`
target type	`Policy`
source	`<scope node (subscription \| resourceGroup)>`
target	`<policy assignment GenericPolicy node>`

Narrative

{scope.name} has a deny-effect Azure Policy assignment {policyAssignment.name} (guardrail - blocks the actions it targets)."

Raw rule rules/explicit/azure-subscriptions.yaml

id: azure-sub-deny-policy-assignment
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.Authorization/policyAssignments
  field: id
where:
- referenced policy definition effect in ['deny','denyAction']
emit:
  source_type: '*'
  target_type: Policy
  source: <scope node (subscription | resourceGroup)>
  target: <policy assignment GenericPolicy node>
  api_source: GET /{scope}/providers/Microsoft.Authorization/policyAssignments
  evidence_field: properties.policyDefinitionId (effect deny/denyAction)
  note: 'Deny-effect Azure Policy is a user-removable guardrail: a principal with Microsoft.Authorization/policyAssignments/write
    or /delete at the scope (Owner / Resource Policy Contributor) can remove or exempt it -> feeds azure-sub-modify-deny-assignment
    (derived).'
  narrative: "{scope.name} has a deny-effect Azure Policy assignment {policyAssignment.name} (guardrail\
    \ \u2014 blocks the actions it targets).\""