azure-vwan-contributor

id: azure-vwan-contributor
emits: CanAdminister
description: Write access to the Virtual WAN or Virtual Hub object (virtualWans/write or virtualHubs/write,
  both included in Network Contributor) grants full control of the vWAN topology, all hub connections,
  route tables, gateways, and routing policy.
applies_to:
- azure
match_effective_permission:
  any_of:
  - action: Microsoft.Network/virtualWans/write
    scope_type: resource|resourceGroup|subscription
  - action: Microsoft.Network/virtualHubs/write
    scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Network Contributor / Contributor / Owner at the vWAN, hub, containing RG,
  or subscription scope
emit:
  source_type: Identity
  target_type: TransitGateway
  source: <principal>
  target: <Virtual WAN or Virtual Hub (TransitGateway node)>
  permissions:
  - Microsoft.Network/virtualWans/write
  - Microsoft.Network/virtualHubs/write
  state_logic: ACTIVE
  false_positive_note: "CanAdminister on a vWAN/hub grants config control (connections, routes, gateways,\
    \ routing intent) but NOT Microsoft.Authorization/*/write; it does not allow RBAC self-assignment.\
    \ CanAdminister \u2192 Controls is derived by can-control.yaml (cited, not duplicated here). Network\
    \ Contributor at RG scope grants write on all Microsoft.Network resources including vWAN and hub objects;\
    \ verify effective scope."
  narrative: '{principal.name} has full administrative control of {target.name} (Microsoft.Network/virtualWans/write
    or virtualHubs/write), including all hub VNet connections, VPN and ExpressRoute gateways, route tables,
    and routing intent policies.'
  derived_from: []