rage.fail

azure-vnet-nsg-contributor

explicit azure emits CanAdminister

match (effective permission)

{ "action": "Microsoft.Network/networkSecurityGroups/write", "resource_type": "Microsoft.Network/networkSecurityGroups" }

where

principal has networkSecurityGroups/write (covers both object-level and rule-level write)

emit

source type	`Identity`
target type	`Firewall`
source	`<principal>`
target	`<NSG>`
permissions	`Microsoft.Network/networkSecurityGroups/write` `Microsoft.Network/networkSecurityGroups/securityRules/write`
state logic	ACTIVE

Narrative

{principal.name} has full control of NSG {target.name} (networkSecurityGroups/write), enabling rule creation, deletion, and priority changes.

Raw rule rules/explicit/azure-vnet.yaml

id: azure-vnet-nsg-contributor
emits: CanAdminister
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Network/networkSecurityGroups/write
  resource_type: Microsoft.Network/networkSecurityGroups
where:
- principal has networkSecurityGroups/write (covers both object-level and rule-level write)
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal>
  target: <NSG>
  permissions:
  - Microsoft.Network/networkSecurityGroups/write
  - Microsoft.Network/networkSecurityGroups/securityRules/write
  state_logic: ACTIVE
  api_source: ARM RBAC effective-permission evaluation
  evidence_field: Role assignment with Microsoft.Network/networkSecurityGroups/write action
  narrative: '{principal.name} has full control of NSG {target.name} (networkSecurityGroups/write), enabling
    rule creation, deletion, and priority changes.'