azure-adls-blob-data-write

id: azure-adls-blob-data-write
emits: CanWriteData
description: Storage Blob Data Contributor/Owner grants effective data-plane write of ADLS Gen2 content.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == DataLake
- ?account.properties.isHnsEnabled == true
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
  at ?account or container scope (Storage Blob Data Contributor ba92f5b4-2d11-453d-a403-e96b0029c9fe or
  Storage Blob Data Owner b7e6dc6d-f1e8-4753-8033-0f276bb0955b)
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND ?principal not in IP/VNet allowlist AND no private
    endpoint path from ?principal to ?account: CONDITIONAL(network_reachability); elif a deny assignment
    or deny Azure Policy covers blobs/write at effective scope: BLOCKED; elif ?principal has Storage Blob
    Data Owner (runAsSuperUser): ACTIVE with no ACL conditions; else ACTIVE subject to per-directory/file
    POSIX ACL evaluation at runtime (ACL denials at paths below are a narrowing of this ACTIVE capability,
    not a blanket block of the RBAC grant itself).'
  confidence: '0.90'
  derived_from:
  - <HasPermission edge_id (blobs/write dataAction)>
  false_positive_note: "POSIX ACL subtlety: Storage Blob Data Contributor RBAC grants blobs/write at the\
    \ ARM level, but POSIX ACLs on individual directories/files in the HNS can additionally deny access\
    \ for those roles. ONLY Storage Blob Data Owner (runAsSuperUser) bypasses ACLs entirely. Model as\
    \ ACTIVE at the account level (RBAC grant is real); ACL-based path narrowing is a runtime enforcement\
    \ that the graph cannot enumerate per-file \u2014 do not try to enumerate it. When the principal is\
    \ Storage Blob Data Owner, note the ACL bypass in the narrative. Network firewall (networkAcls.defaultAction=Deny)\
    \ gates the storage data-plane endpoint \u2014 apply CONDITIONAL(network_reachability) for external\
    \ callers without an allowlisted IP/VNet or PE path. The downstream CanModifyCode pivot (poisoned\
    \ ML model weights / Spark scripts / DAG files consumed by Synapse / Databricks / AML compute) is\
    \ handled by compute service rules via cicd-chains linchpin, not here. Storage Blob Data Reader does\
    \ NOT grant write \u2014 do not conflate."
  narrative: '{principal.name} holds the blobs/write dataAction on {account.name} (Storage Blob Data Contributor
    or Storage Blob Data Owner), enabling data-plane write and modification of all blob and file content
    in this ADLS Gen2 account, including poisoning ML model weights, analytics artifacts, and executable
    configurations consumed by downstream compute services. POSIX ACLs may restrict access to specific
    paths unless the principal holds Storage Blob Data Owner (runAsSuperUser bypasses all ACLs).'