rage.fail

azure-sub-enter-subscription

A principal that controls or administers a subscription has a control-plane foothold inside it.

derived azure emits CanEnterSubscription

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} {'cap': None} {'sub': None}

where

?cap in [Controls, CanAdminister] node_class(?sub) == AdministrativeBoundary and node_type(?sub) == Subscription

emit

source type	`Identity`
target type	`Subscription`
source	`?principal`
target	`?sub`
state logic	Inherit the state of the contributing Controls/CanAdminister edge exactly (ACTIVE/CONDITIONAL/BLOCKED). Never stronger than its contributor.

Narrative

{principal.name} controls subscription {sub.name} and therefore has a control-plane foothold inside it.

Raw rule rules/derived/azure/subscriptions.yaml

id: azure-sub-enter-subscription
emits: CanEnterSubscription
description: A principal that controls or administers a subscription has a control-plane foothold inside
  it.
match:
- - principal: null
  - cap: null
  - sub: null
where:
- ?cap in [Controls, CanAdminister]
- node_class(?sub) == AdministrativeBoundary and node_type(?sub) == Subscription
emit:
  source_type: Identity
  target_type: Subscription
  source: ?principal
  target: ?sub
  permissions: []
  conditions: []
  state_logic: Inherit the state of the contributing Controls/CanAdminister edge exactly (ACTIVE/CONDITIONAL/BLOCKED).
    Never stronger than its contributor.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal Controls|CanAdminister ?sub
  false_positive_note: "Emit ONLY for the Subscription boundary (Subscription has a dedicated CanEnter*\
    \ edge; ResourceGroup does NOT \u2014 an RG surfaces only as Controls/ CanAdminister and propagates\
    \ via hierarchy-chains descent). Do not upgrade a CONDITIONAL/BLOCKED contributor. This mirrors can-control\
    \ enter-account-via-assume for the Azure subscription case referenced in can-control.yaml."
  narrative: '{principal.name} controls subscription {sub.name} and therefore has a control-plane foothold
    inside it.'