azure-aml-online-endpoint-listkeys
Retrieve the API key for a key-authenticated online endpoint via listkeys/action; required to invoke public endpoints.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listkeys/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
onlineEndpoint authMode == Key
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <online endpoint scoring API key> |
| permissions | Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listkeys/action |
Narrative
{principal.name} can retrieve the scoring API key for online endpoint {target.name} (onlineEndpoints/listkeys/action), enabling unauthenticated invocations if the endpoint is ExposedToInternet.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-online-endpoint-listkeys
emits: CanReadSecret
description: Retrieve the API key for a key-authenticated online endpoint via listkeys/action; required
to invoke public endpoints.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listkeys/action
scope_type: resource|resourceGroup|subscription
where:
- onlineEndpoint authMode == Key
emit:
source_type: Identity
source: <principal>
target: <online endpoint scoring API key>
permissions:
- Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listkeys/action
note: The scoring key is a shared secret allowing unauthenticated invocation of the online endpoint.
Retrieving it via listkeys/action yields a credential for the endpoint API. Pair with ExposedToInternet
on the endpoint to complete the attack path.
false_positive_note: Only emit for endpoints with authMode=Key. Token-authenticated (AAD) endpoints
do not have a listkeys secret; they require Azure AD authentication instead. The endpoint URL alone
is not exploitable without the scoring key.
narrative: '{principal.name} can retrieve the scoring API key for online endpoint {target.name} (onlineEndpoints/listkeys/action),
enabling unauthenticated invocations if the endpoint is ExposedToInternet.'