azure-adls-blob-data-reader

id: azure-adls-blob-data-reader
emits: CanReadData
description: Storage Blob Data Reader/Contributor/Owner grants effective data-plane read of ADLS Gen2
  content.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == DataLake
- ?account.properties.isHnsEnabled == true
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
  at ?account or container scope (Storage Blob Data Reader 2a2b9908-6ea1-4ae2-8e65-a410df84e7d1, Storage
  Blob Data Contributor ba92f5b4-2d11-453d-a403-e96b0029c9fe, or Storage Blob Data Owner b7e6dc6d-f1e8-4753-8033-0f276bb0955b)
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
  conditions:
  - iam_permission
  state_logic: 'conditions field populated at evaluation time based on principal''s network access: if
    ?principal is in-VNet allowlist or has private endpoint path: conditions=[iam_permission]; elif networkAcls.defaultAction
    == Deny AND ?principal not in IP/VNet allowlist AND no private endpoint path: conditions=[iam_permission,
    network_reachability] CONDITIONAL(network_reachability); elif a deny assignment or deny Azure Policy
    covers blobs/read at effective scope: BLOCKED; elif ?principal has Storage Blob Data Owner (runAsSuperUser):
    ACTIVE with no ACL conditions; else ACTIVE subject to per-directory/file POSIX ACL evaluation at runtime
    (ACL denials at paths below are a narrowing of this ACTIVE capability, not a blanket block of the
    RBAC grant itself).'
  confidence: '0.90'
  derived_from:
  - <HasPermission edge_id (blobs/read dataAction)>
  false_positive_note: "POSIX ACL subtlety: Storage Blob Data Reader/Contributor RBAC grants blobs/read\
    \ at the ARM level, but POSIX ACLs on individual directories/files in the HNS can additionally deny\
    \ access for those roles. ONLY Storage Blob Data Owner (runAsSuperUser) bypasses ACLs entirely. Model\
    \ as ACTIVE at the account level (RBAC grant is real); ACL-based path narrowing is a runtime enforcement\
    \ that the graph cannot enumerate per-file \u2014 do not try to enumerate it. When the principal is\
    \ Storage Blob Data Owner, note the ACL bypass in the narrative. Network firewall (networkAcls.defaultAction=Deny)\
    \ gates the storage data-plane endpoint \u2014 apply CONDITIONAL(network_reachability) for external\
    \ callers without an allowlisted IP/VNet or PE path. Do NOT apply a network condition to the ARM listKeys\
    \ call (separate rule, different network gate). Storage Blob Data Reader does NOT grant listKeys \u2014\
    \ do not conflate."
  narrative: '{principal.name} holds the blobs/read dataAction on {account.name} (Storage Blob Data Reader
    or higher), enabling data-plane read of all blob and file content in this ADLS Gen2 account. POSIX
    ACLs may restrict access to specific paths unless the principal holds Storage Blob Data Owner (runAsSuperUser
    bypasses all ACLs).'