rage.fail

azure-vm-login-dataaction

derived azure emits CanExecuteCommand

match (effective permission)

{ "action": "Microsoft.Compute/virtualMachines/login/action OR Microsoft.Compute/virtualMachines/loginAsAdmin/action", "data_action": true, "scope_type": "resource|resourceGroup|subscription" }

where

VM has the AADSSHLoginForLinux / AADLoginForWindows extension network path to SSH/RDP or Bastion exists

emit

source type	`Identity`
source	`<principal>`
target	`<virtualMachine>`
permissions	`Microsoft.Compute/virtualMachines/loginAsAdmin/action`
conditions	`service_state` `network_reachability`

Narrative

{principal.name} can interactively log in to {target.name} as admin (loginAsAdmin data action) and run commands.

Raw rule rules/derived/azure/vm.yaml

id: azure-vm-login-dataaction
emits: CanExecuteCommand
match_effective_permission:
  action: Microsoft.Compute/virtualMachines/login/action OR Microsoft.Compute/virtualMachines/loginAsAdmin/action
  data_action: true
  scope_type: resource|resourceGroup|subscription
where:
- VM has the AADSSHLoginForLinux / AADLoginForWindows extension
- network path to SSH/RDP or Bastion exists
emit:
  source_type: Identity
  source: <principal>
  target: <virtualMachine>
  permissions:
  - Microsoft.Compute/virtualMachines/loginAsAdmin/action
  conditions:
  - service_state
  - network_reachability
  false_positive_note: These are DATA actions granted ONLY by Virtual Machine Administrator/User Login
    roles; VM Contributor/Owner do NOT include them. Require the Entra-login extension AND a reachable
    SSH/RDP/Bastion path.
  narrative: '{principal.name} can interactively log in to {target.name} as admin (loginAsAdmin data action)
    and run commands.'