rage.fail

azure-vnet-contributor

explicit azure emits CanAdminister

match (effective permission)

{ "action": "Microsoft.Network/virtualNetworks/write", "resource_type": "Microsoft.Network/virtualNetworks" }

emit

source type	`Identity`
target type	`VirtualNetwork`
source	`<principal>`
target	`<VNet>`
permissions	`Microsoft.Network/virtualNetworks/write`
state logic	ACTIVE

Narrative

{principal.name} has full control of VNet {target.name} (Microsoft.Network/virtualNetworks/write), including its subnets, peerings, DNS settings, and associated route tables.

Raw rule rules/explicit/azure-vnet.yaml

id: azure-vnet-contributor
emits: CanAdminister
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Network/virtualNetworks/write
  resource_type: Microsoft.Network/virtualNetworks
emit:
  source_type: Identity
  target_type: VirtualNetwork
  source: <principal>
  target: <VNet>
  permissions:
  - Microsoft.Network/virtualNetworks/write
  state_logic: ACTIVE
  api_source: ARM RBAC effective-permission evaluation
  evidence_field: Role assignment with Microsoft.Network/virtualNetworks/write action
  narrative: '{principal.name} has full control of VNet {target.name} (Microsoft.Network/virtualNetworks/write),
    including its subnets, peerings, DNS settings, and associated route tables.'