azure-vmss-execute-as-via-attach-identity
Attach a chosen MI to the fleet + drive instance refresh => execute as the attached MI.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal can cause an instance to (re)boot the model: reimage/osRollingUpgrade/start/action OR capacity increase via virtualMachineScaleSets/write
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <attached managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.Compute/virtualMachineScaleSets/write |
| conditions | service_state role_compatibility |
| state logic | ACTIVE if attacker holds reimage/upgrade/start/capacity else CONDITIONAL(service_state). Encoded via conditions:[service_state] so the engine computes state from the schema-defined condition; state_logic is retained only as an annotation. |
Narrative
{principal.name} can attach MI {mi.name} to {vmss.name} and refresh instances, executing as {mi.name}.
Raw rule rules/derived/azure/vmss.yaml
id: azure-vmss-execute-as-via-attach-identity
emits: CanExecuteAs
description: Attach a chosen MI to the fleet + drive instance refresh => execute as the attached MI.
match:
- - principal: null
- CanAttachIdentity
- vmss: null
where:
- '?principal can cause an instance to (re)boot the model: reimage/osRollingUpgrade/start/action OR capacity
increase via virtualMachineScaleSets/write'
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <attached managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
- Microsoft.Compute/virtualMachineScaleSets/write
conditions:
- service_state
- role_compatibility
state_logic: ACTIVE if attacker holds reimage/upgrade/start/capacity else CONDITIONAL(service_state).
Encoded via conditions:[service_state] so the engine computes state from the schema-defined condition;
state_logic is retained only as an annotation.
escalation: Bind an arbitrary user-assigned MI to the fleet, refresh instances, then read its token.
narrative: '{principal.name} can attach MI {mi.name} to {vmss.name} and refresh instances, executing
as {mi.name}.'