azure-adf-listauthkeys-readcred

id: azure-adf-listauthkeys-readcred
emits: CanReadCredential
description: Retrieve authentication keys for linked services via listAuthKeys/action, directly accessing
  the plaintext credential without parsing typeProperties.
match_effective_permission:
  action: Microsoft.DataFactory/factories/linkedservices/listAuthKeys/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Credential
  source: <principal>
  target: <linked service authentication key (AccessKey / Credential node)>
  permissions:
  - Microsoft.DataFactory/factories/linkedservices/listAuthKeys/action
  conditions: []
  state_logic: 'ACTIVE when the effective permission is confirmed. listAuthKeys/action directly retrieves
    plaintext authentication material for the linked service (storage keys, connection strings, SP client
    secrets), bypassing the need to parse typeProperties. BLOCKED if a deny assignment covers the action.
    Note: this is a data-plane action; it requires a valid bearer token or ARM credentials.'
  confidence: 0.93
  derived_from:
  - 'effective permission: Microsoft.DataFactory/factories/linkedservices/listAuthKeys/action'
  false_positive_note: listAuthKeys/action is a dedicated credential-retrieval method distinct from linkedservices/read
    (which returns the full resource definition). The action is granted to custom roles that need to manage
    linked service credentials without read access to the full resource. Higher confidence than linkedservice-read-secret
    because the action is explicitly for credential access. credential-chains read-secret-yields-identity
    rolls up CanReadCredential + CredentialsFor -> CanImpersonate; do not re-derive.
  narrative: '{principal.name} can retrieve authentication keys for linked services (Microsoft.DataFactory/factories/linkedservices/listAuthKeys/action),
    exposing plaintext storage keys, connection strings, and service-principal client secrets.'