azure-acr-token-list-passwords
tokens/listPasswords/action returns long-lived passwords for a repository-scoped token - principal can retrieve static credential valid for the actions in the token's scope map.
match (effective permission)
{
"action": "Microsoft.ContainerRegistry/registries/tokens/listPasswords/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role including Microsoft.
ContainerRegistry/registries/tokens/listPasswords/action
target token status == enabled
emit
| source type | Identity |
|---|---|
| target type | Credential |
| source | <principal holding tokens/listPasswords/action> |
| target | <token password Credential> |
| permissions | Microsoft.ContainerRegistry/registries/tokens/listPasswords/action |
| state logic | ACTIVE when the token status == enabled and the principal holds tokens/listPasswords/action. CONDITIONAL(service_state) when the token is disabled. The scope map restricts what the token password can do (push, pull, delete, per repository) — record the scope map's actions as conditions on any downstream CanModifyCode edge derived from this credential. |
Narrative
{source.name} can retrieve {target.name} (repository-scoped token password) via tokens/listPasswords/action; when the token is enabled, the principal gains HTTP Basic authentication scoped to the actions and repositories in the token's scope map - which may include push/write and thus supply-chain access. credential-chains will derive CanImpersonate when the credential CredentialsFor an identity.
Raw rule rules/derived/azure/acr.yaml
id: azure-acr-token-list-passwords
emits: CanReadCredential
description: "tokens/listPasswords/action returns long-lived passwords for a repository-scoped token \u2014\
\ principal can retrieve static credential valid for the actions in the token's scope map."
match_effective_permission:
action: Microsoft.ContainerRegistry/registries/tokens/listPasswords/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role including Microsoft.ContainerRegistry/registries/tokens/listPasswords/action
- target token status == enabled
emit:
source_type: Identity
target_type: Credential
source: <principal holding tokens/listPasswords/action>
target: <token password Credential>
permissions:
- Microsoft.ContainerRegistry/registries/tokens/listPasswords/action
state_logic: "ACTIVE when the token status == enabled and the principal holds tokens/listPasswords/action.\
\ CONDITIONAL(service_state) when the token is disabled. The scope map restricts what the token password\
\ can do (push, pull, delete, per repository) \u2014 record the scope map's actions as conditions\
\ on any downstream CanModifyCode edge derived from this credential."
confidence: 0.92
derived_from:
- "credential-chains read-secret-yields-identity (CITED \u2014 consumes CanReadCredential + CredentialsFor\
\ to produce CanImpersonate)"
false_positive_note: "Token scope maps may restrict this to pull-only (no push) \u2014 in that case\
\ the credential does not enable supply-chain poisoning and should NOT feed a CanModifyCode derivation.\
\ Verify the scopeMap.actions to determine push capability. Token passwords are long-lived (no session\
\ TTL) and persist until regenerated or the token is deleted. Two passwords exist per token (password\
\ and password2); rotating one does not invalidate the other. The separate explicit rule (azure-acr-token-credential-present)\
\ models the structural ContainsCredential(token\u2192password) fact; this derived rule models the\
\ principal's retrieval capability."
narrative: "{source.name} can retrieve {target.name} (repository-scoped token password) via tokens/listPasswords/action;\
\ when the token is enabled, the principal gains HTTP Basic authentication scoped to the actions and\
\ repositories in the token's scope map \u2014 which may include push/write and thus supply-chain\
\ access. credential-chains will derive CanImpersonate when the credential CredentialsFor an identity."