rage.fail

azure-vmss-executes-as

derived azure emits ExecutesAs

match (record)

{ "field": "identity", "resource_type": "Microsoft.Compute/virtualMachineScaleSets" }

where

identity.type includes SystemAssigned OR identity.userAssignedIdentities is non-empty

emit

source type	`Compute`
source	`<vmss instance / scale set compute node>`
target	`<managed identity from identity block>`

Narrative

{compute.name} executes as managed identity {identity.name} (scale-set identity block).

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-executes-as
emits: ExecutesAs
match_record:
  resource_type: Microsoft.Compute/virtualMachineScaleSets
  field: identity
where:
- identity.type includes SystemAssigned OR identity.userAssignedIdentities is non-empty
emit:
  source_type: Compute
  source: <vmss instance / scale set compute node>
  target: <managed identity from identity block>
  api_source: Microsoft.Compute/virtualMachineScaleSets/read
  evidence_field: identity.type / identity.userAssignedIdentities
  false_positive_note: If identity.type is None (no MI), emit nothing; code execution then yields only
    host access, not CanExecuteAs.
  narrative: '{compute.name} executes as managed identity {identity.name} (scale-set identity block).'