azure-sub-owner-controls

Owner at a subscription or resource group controls that boundary (full actions incl. RBAC assignment).

derived azure emits Controls

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'scope': None}

where

node_class(?scope) == AdministrativeBoundary and node_type(?scope) in [Subscription, ResourceGroup] ?principal has EFFECTIVE actions '*' at ?scope INCLUDING Microsoft.Authorization/roleAssignments/write (Owner 8e3af657-a8ff-443c-a75c-2fe8c4bcb635, or a custom role whose actions resolve to a superset with roleAssignments/write)

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?scope`
permissions	`*` `Microsoft.Authorization/roleAssignments/write`
conditions	`deny_assignment` `condition_expression` `pim_activation`
state logic	ACTIVE when the Owner assignment is unconditional and active. CONDITIONAL when the assignment carries an ABAC condition (condition/conditionVersion) or is a PIM ELIGIBLE (not activated) assignment -> CONDITIONAL(condition_expression) / CONDITIONAL(pim_activation). BLOCKED when a deny assignment or deny Azure Policy at/above ?scope covers the relevant actions (deny wins over role assignment) UNLESS excludePrincipals lists ?principal or doNotApplyToChildScopes exempts ?scope -> then not blocked. A BLOCKED Controls is upgraded only by hierarchy-chains guardrail-removal-upgrades-blocked.

Narrative

{principal.name} holds Owner at {scope.name} and therefore controls it, including the ability to assign roles - control inherits to every resource group and resource beneath it.

Raw rule rules/derived/azure/subscriptions.yaml

id: azure-sub-owner-controls
emits: Controls
description: Owner at a subscription or resource group controls that boundary (full actions incl. RBAC
  assignment).
match:
- - principal: null
  - HasPermission
  - scope: null
where:
- node_class(?scope) == AdministrativeBoundary and node_type(?scope) in [Subscription, ResourceGroup]
- ?principal has EFFECTIVE actions '*' at ?scope INCLUDING Microsoft.Authorization/roleAssignments/write
  (Owner 8e3af657-a8ff-443c-a75c-2fe8c4bcb635, or a custom role whose actions resolve to a superset with
  roleAssignments/write)
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?scope
  permissions:
  - '*'
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - deny_assignment
  - condition_expression
  - pim_activation
  state_logic: ACTIVE when the Owner assignment is unconditional and active. CONDITIONAL when the assignment
    carries an ABAC condition (condition/conditionVersion) or is a PIM ELIGIBLE (not activated) assignment
    -> CONDITIONAL(condition_expression) / CONDITIONAL(pim_activation). BLOCKED when a deny assignment
    or deny Azure Policy at/above ?scope covers the relevant actions (deny wins over role assignment)
    UNLESS excludePrincipals lists ?principal or doNotApplyToChildScopes exempts ?scope -> then not blocked.
    A BLOCKED Controls is upgraded only by hierarchy-chains guardrail-removal-upgrades-blocked.
  confidence: '0.95'
  derived_from:
  - <HasPermission edge_id (Owner / '*' incl roleAssignments/write @scope)>
  false_positive_note: "Owner ONLY \u2014 do NOT fire on Contributor (it lacks Microsoft.Authorization/*/write).\
    \ Resolve custom roles by their effective actions, not display name: a role must actually include\
    \ Microsoft.Authorization/roleAssignments/write (or actions '*' without an Authorization NotActions)\
    \ to qualify. Respect ABAC conditions and PIM eligibility (CONDITIONAL, not ACTIVE). This Controls(?scope)\
    \ feeds hierarchy-chains admin-inherits-down-contains for the subtree; do NOT enumerate descendants\
    \ here."
  narrative: "{principal.name} holds Owner at {scope.name} and therefore controls it, including the ability\
    \ to assign roles \u2014 control inherits to every resource group and resource beneath it."