azure-adf-pipeline-read-secret
Read an ADF pipeline definition containing inline SAS URLs, API keys, or connection strings in activity url/body parameters.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/pipelines/read",
"scope_type": "resource|resourceGroup|subscription"
}
where
the pipeline definition contains inline credential material in activity properties (url, body, connection string parameters,
API keys)
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <credential embedded in pipeline activity (APIKey / ConnectionString / Secret node)> |
| permissions | Microsoft.DataFactory/factories/pipelines/read |
| state logic | ACTIVE when the effective permission is confirmed AND the pipeline definition contains verifiable inline credential material in activity parameters (not a linked-service reference). CONDITIONAL when credentials are indirect references to linked services. BLOCKED if a deny assignment covers pipelines/read. |
Narrative
{principal.name} can read pipeline definition {target.name} (Microsoft.DataFactory/factories/pipelines/read), exposing inline credential material (SAS URL, API key, connection string) embedded in activity parameters.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-pipeline-read-secret
emits: CanReadSecret
description: Read an ADF pipeline definition containing inline SAS URLs, API keys, or connection strings
in activity url/body parameters.
match_effective_permission:
action: Microsoft.DataFactory/factories/pipelines/read
scope_type: resource|resourceGroup|subscription
where:
- the pipeline definition contains inline credential material in activity properties (url, body, connection
string parameters, API keys)
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <credential embedded in pipeline activity (APIKey / ConnectionString / Secret node)>
permissions:
- Microsoft.DataFactory/factories/pipelines/read
conditions: []
state_logic: ACTIVE when the effective permission is confirmed AND the pipeline definition contains
verifiable inline credential material in activity parameters (not a linked-service reference). CONDITIONAL
when credentials are indirect references to linked services. BLOCKED if a deny assignment covers pipelines/read.
confidence: 0.82
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/pipelines/read'
- '<ContainsSecret edge: ?pipeline -> ?credential>'
false_positive_note: "Pipeline activities can embed credentials directly in their url, body, or connection\
\ string parameters \u2014 these are readable at Reader level (pipelines/read). If credentials are\
\ stored in linked services only, resolve via azure-adf-linkedservice-read-secret instead. Inline\
\ credentials are often in Copy source/sink url parameters, Web activity headers, or Custom activity\
\ body. The ARM API returns the pipeline definition JSON with credentials plaintext; many organizations\
\ restrict pipelines/read above Reader to limit exposure."
narrative: '{principal.name} can read pipeline definition {target.name} (Microsoft.DataFactory/factories/pipelines/read),
exposing inline credential material (SAS URL, API key, connection string) embedded in activity parameters.'