rage.fail

azure-vmss-execute-as-via-command

Run-command on an instance that executes as an MI => execute as that MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'vmss_instance': None} {'vmss_instance': None} ExecutesAs {'mi': None}

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action`
conditions	`service_state`
state logic	ACTIVE if the target instance is running else CONDITIONAL(service_state). Encoded via conditions:[service_state] so the engine computes state from the schema-defined condition; state_logic is retained only as an annotation.

Narrative

{principal.name} can run commands on {instance.name}, which executes as {mi.name}, thereby executing as {mi.name}.

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-execute-as-via-command
emits: CanExecuteAs
description: Run-command on an instance that executes as an MI => execute as that MI.
match:
- - principal: null
  - CanExecuteCommand
  - vmss_instance: null
- - vmss_instance: null
  - ExecutesAs
  - mi: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  permissions:
  - Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action
  conditions:
  - service_state
  state_logic: ACTIVE if the target instance is running else CONDITIONAL(service_state). Encoded via conditions:[service_state]
    so the engine computes state from the schema-defined condition; state_logic is retained only as an
    annotation.
  conditions_from:
  - vmss_instance: null
  - mi: null
  narrative: '{principal.name} can run commands on {instance.name}, which executes as {mi.name}, thereby
    executing as {mi.name}.'