azure-adf-linkedservice-read-secret
Read an ADF linked service definition that contains inline connection string, storage key, SP client secret, or password.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/linkedservices/read",
"scope_type": "resource|resourceGroup|subscription"
}
where
the linked service typeProperties contains inline credential material (connectionString, accountKey, clientSecret, password, sasUri, or accessToken value) — NOT a Key Vault reference
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <credential embedded in the linked service (ConnectionString / AccessKey / Secret node)> |
| permissions | Microsoft.DataFactory/factories/linkedservices/read |
| state logic | ACTIVE when the effective permission is confirmed AND the linked service typeProperties carries inline credential material (not a Key Vault reference). CONDITIONAL when the linked service uses a Key Vault reference — the credential is in Key Vault; reading the linked service reveals the secret URL/name but not the plaintext (resolve Key Vault separately). BLOCKED if a deny assignment covers linkedservices/read. |
Narrative
{principal.name} can read linked service {target.name} (Microsoft.DataFactory/factories/linkedservices/read), exposing an inline connection string, storage account key, service-principal client secret, or password stored in the linked service definition.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-linkedservice-read-secret
emits: CanReadSecret
description: Read an ADF linked service definition that contains inline connection string, storage key,
SP client secret, or password.
match_effective_permission:
action: Microsoft.DataFactory/factories/linkedservices/read
scope_type: resource|resourceGroup|subscription
where:
- "the linked service typeProperties contains inline credential material (connectionString, accountKey,\
\ clientSecret, password, sasUri, or accessToken value) \u2014 NOT a Key Vault reference"
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <credential embedded in the linked service (ConnectionString / AccessKey / Secret node)>
permissions:
- Microsoft.DataFactory/factories/linkedservices/read
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed AND the linked service typeProperties\
\ carries inline credential material (not a Key Vault reference). CONDITIONAL when the linked service\
\ uses a Key Vault reference \u2014 the credential is in Key Vault; reading the linked service reveals\
\ the secret URL/name but not the plaintext (resolve Key Vault separately). BLOCKED if a deny assignment\
\ covers linkedservices/read."
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/linkedservices/read'
- '<ContainsSecret edge: ?linkedservice -> ?credential>'
false_positive_note: "Only emit when the linked service typeProperties contains verifiable inline credential\
\ material. A Key Vault reference (typeProperties.*.type == AzureKeyVaultSecret) is NOT inline \u2014\
\ emit ContainsResourceReference (pointing to the KV secret) and resolve Key Vault access separately.\
\ The ARM API returns the typeProperties JSON at Reader level; many organizations restrict linkedservices/read\
\ above Reader to limit credential exposure. credential-chains read-secret-yields-identity rolls up\
\ CanReadSecret + CredentialsFor -> CanImpersonate; do not re-derive."
narrative: '{principal.name} can read linked service {target.name} (Microsoft.DataFactory/factories/linkedservices/read),
exposing an inline connection string, storage account key, service-principal client secret, or password
stored in the linked service definition.'