azure-vnet-nsg-write
Write access to the NSG object itself (create/replace) gives equivalent capability to rewrite all security rules, effectively bypassing any existing rule set.
match (effective permission)
{
"action": "Microsoft.Network/networkSecurityGroups/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <NSG> |
| permissions | Microsoft.Network/networkSecurityGroups/write |
| state logic | ACTIVE |
Narrative
{principal.name} can write the NSG object {target.name} (networkSecurityGroups/write), enabling rule replacement or wholesale NSG substitution.
Raw rule rules/derived/azure/vnet.yaml
id: azure-vnet-nsg-write
emits: CanModifyConfiguration
description: Write access to the NSG object itself (create/replace) gives equivalent capability to rewrite
all security rules, effectively bypassing any existing rule set.
match_effective_permission:
action: Microsoft.Network/networkSecurityGroups/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <NSG>
permissions:
- Microsoft.Network/networkSecurityGroups/write
state_logic: ACTIVE
false_positive_note: "networkSecurityGroups/write allows creating a new NSG or replacing an existing\
\ one's metadata; combined with securityRules/write (or included via wildcard) it allows full rule\
\ replacement. If the effective permission is only /write without /securityRules/write, the attacker\
\ can still create a new NSG object \u2014 associating it with a subnet requires virtualNetworks/subnets/write.\
\ Honor the scope of the grant."
narrative: '{principal.name} can write the NSG object {target.name} (networkSecurityGroups/write), enabling
rule replacement or wholesale NSG substitution.'
derived_from:
- '<effective permission record: networkSecurityGroups/write>'