rage.fail

azure-vmss-run-command

derived azure emits CanExecuteCommand

match (effective permission)

{ "action": "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action", "scope_type": "resource|resourceGroup|subscription|mg" }

emit

source type	`Identity`
source	`<principal>`
target	`<scale set instance>`
permissions	`Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action`
conditions	`service_state`

Narrative

{principal.name} can run commands on instance {instance.name} of {vmss.name} (virtualMachineScaleSets/virtualMachines/runCommand/action).

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-run-command
emits: CanExecuteCommand
match_effective_permission:
  action: Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action
  scope_type: resource|resourceGroup|subscription|mg
emit:
  source_type: Identity
  source: <principal>
  target: <scale set instance>
  permissions:
  - Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action
  conditions:
  - service_state
  escalation: Run an arbitrary script on an instance as the scale-set MI (SYSTEM/root), then read its
    IMDS token.
  false_positive_note: Execution requires the target instance to be running with a healthy/provisioned
    VM agent; on a stopped or deallocated instance (or one without a responsive agent) the edge is CONDITIONAL(service_state)
    and only realizes once the instance is started (see azure-vmss-start / azure-vmss-execute-as-via-command
    state gating). Azure Policy can restrict run-command; deny -> BLOCKED. Only meaningful for escalation
    if the fleet has an MI (see IMDS rule).
  narrative: '{principal.name} can run commands on instance {instance.name} of {vmss.name} (virtualMachineScaleSets/virtualMachines/runCommand/action).'