azure-vnet-nsg-rule-write
Write access to NSG security rules lets an attacker add an inbound allow rule (e.g., source=Any, port=*, action=Allow) to open previously blocked network paths.
match (effective permission)
{
"action": "Microsoft.Network/networkSecurityGroups/securityRules/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <NSG> |
| permissions | Microsoft.Network/networkSecurityGroups/securityRules/write |
| state logic | ACTIVE: the principal can add or modify a security rule immediately; no secondary condition required. Effect is realized when an existing or new rule is written. |
Narrative
{principal.name} can add or modify NSG security rules on {target.name} (networkSecurityGroups/securityRules/write), enabling them to open inbound allow rules and expand network reachability.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-nsg-rule-write
emits: CanModifyConfiguration
description: Write access to NSG security rules lets an attacker add an inbound allow rule (e.g., source=Any,
port=*, action=Allow) to open previously blocked network paths.
match_effective_permission:
action: Microsoft.Network/networkSecurityGroups/securityRules/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <NSG>
permissions:
- Microsoft.Network/networkSecurityGroups/securityRules/write
state_logic: 'ACTIVE: the principal can add or modify a security rule immediately; no secondary condition
required. Effect is realized when an existing or new rule is written.'
false_positive_note: "A deny assignment covering networkSecurityGroups/securityRules/write at the NSG\
\ or RG scope blocks this capability -> emit BLOCKED. Network Contributor includes this action; custom\
\ roles may scope it more narrowly. The write action alone does not open traffic; it enables the ATTACKER\
\ to open it \u2014 this edge records the capability, not an existing open rule."
narrative: '{principal.name} can add or modify NSG security rules on {target.name} (networkSecurityGroups/securityRules/write),
enabling them to open inbound allow rules and expand network reachability.'
derived_from:
- '<effective permission record: networkSecurityGroups/securityRules/write>'