azure-vmss-execute-as-via-code
Modify the fleet's code/config + it executes as an MI => execute as that MI.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?vmss_instance is an instance of ?vmss
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanModifyConfiguration {'vmss': None}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <managed identity> |
| permissions | Microsoft.Compute/virtualMachineScaleSets/extensions/write | virtualMachineScaleSets/write |
| conditions | service_state |
| state logic | ACTIVE if attacker also holds reimage/osRollingUpgrade/start/capacity (new or refreshed instances run the code) else CONDITIONAL(service_state). Encoded via conditions:[service_state] so the engine computes state from the schema-defined condition rather than this prose field; state_logic is retained only as an annotation and should not be relied on if the engine ignores non-schema fields. |
Narrative
{principal.name} can modify the code/model of {vmss.name}, which executes as {mi.name}, thereby executing as {mi.name}.
Raw rule rules/derived/azure/vmss.yaml
id: azure-vmss-execute-as-via-code
emits: CanExecuteAs
description: Modify the fleet's code/config + it executes as an MI => execute as that MI.
match:
- - principal: null
- CanModifyCode
- vmss: null
- - vmss_instance: null
- ExecutesAs
- mi: null
optional:
- - principal: null
- CanModifyConfiguration
- vmss: null
where:
- ?vmss_instance is an instance of ?vmss
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <managed identity>
permissions:
- Microsoft.Compute/virtualMachineScaleSets/extensions/write | virtualMachineScaleSets/write
conditions:
- service_state
state_logic: ACTIVE if attacker also holds reimage/osRollingUpgrade/start/capacity (new or refreshed
instances run the code) else CONDITIONAL(service_state). Encoded via conditions:[service_state] so
the engine computes state from the schema-defined condition rather than this prose field; state_logic
is retained only as an annotation and should not be relied on if the engine ignores non-schema fields.
conditions_from:
- vmss: null
- mi: null
false_positive_note: Model/extension change is inert until an instance runs it; extension write on a
running fleet with auto-upgrade applies sooner than plain model write. Require an MI to exist.
narrative: '{principal.name} can modify the code/model of {vmss.name}, which executes as {mi.name},
thereby executing as {mi.name}.'