azure-vmss-assign-user-mi
match (effective permission)
{
"action": "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
"scope_type": "resource (the target MI)"
}
where
principal also has Microsoft.Compute/virtualMachineScaleSets/write on the scale set (or create) to bind the MI
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.Compute/virtualMachineScaleSets/write |
| conditions | role_compatibility iam_permission |
Narrative
{principal.name} can assign user-assigned MI {mi.name} (userAssignedIdentities/assign/action) and bind it to a scale set it can write.
Raw rule rules/derived/azure/vmss.yaml
id: azure-vmss-assign-user-mi
emits: CanPassIdentity
match_effective_permission:
action: Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
scope_type: resource (the target MI)
where:
- principal also has Microsoft.Compute/virtualMachineScaleSets/write on the scale set (or create) to bind
the MI
emit:
source_type: Identity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
- Microsoft.Compute/virtualMachineScaleSets/write
conditions:
- role_compatibility
- iam_permission
note: Pairs with VMSS write -> CanAttachIdentity -> CanExecuteAs(MI). This is the Azure PassRole analog.
false_positive_note: Contributor / Virtual Machine (Scale Set) Contributor do NOT include the assign/action;
only Managed Identity Operator (or a custom role) grants it. Without it, VMSS write cannot attach
a user-assigned MI.
narrative: '{principal.name} can assign user-assigned MI {mi.name} (userAssignedIdentities/assign/action)
and bind it to a scale set it can write.'