rage.fail

azure-vmss-attach-identity

assign/action on an MI + VMSS write => can attach/replace the identity the fleet runs as.

derived azure emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'mi': None}

where

?principal has effective Microsoft.Compute/virtualMachineScaleSets/write on ?vmss ?mi is a user-assigned managed identity assignable to compute

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<scale set>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Compute/virtualMachineScaleSets/write`

Narrative

{principal.name} can attach managed identity {mi.name} to {vmss.name} and thereby run code as it.

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-attach-identity
emits: CanAttachIdentity
description: assign/action on an MI + VMSS write => can attach/replace the identity the fleet runs as.
match:
- - principal: null
  - CanPassIdentity
  - mi: null
where:
- ?principal has effective Microsoft.Compute/virtualMachineScaleSets/write on ?vmss
- ?mi is a user-assigned managed identity assignable to compute
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <scale set>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Compute/virtualMachineScaleSets/write
  note: Chains to CanExecuteAs(mi) once instances refresh (see azure-vmss-execute-as-via-attach-identity).
  narrative: '{principal.name} can attach managed identity {mi.name} to {vmss.name} and thereby run code
    as it.'