rage.fail

azure-appconfig-access-keys-present

explicit azure emits ContainsCredential

match (record)

{ "field": "properties.disableLocalAuth", "resource_type": "Microsoft.AppConfiguration/configurationStores" }

where

properties.disableLocalAuth == false

emit

source	`<store data-plane node (class Data)>`
target	`<access-key connection string Credential node (read-only + read-write)>`

Narrative

{store.name}'s data plane has access-key connection strings (local auth enabled).

Raw rule rules/explicit/azure-appconfig.yaml

id: azure-appconfig-access-keys-present
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.AppConfiguration/configurationStores
  field: properties.disableLocalAuth
where:
- properties.disableLocalAuth == false
emit:
  source: <store data-plane node (class Data)>
  target: <access-key connection string Credential node (read-only + read-write)>
  api_source: az appconfig show (properties.disableLocalAuth); presence inferred, listKeys NOT invoked
  evidence_field: properties.disableLocalAuth == false
  narrative: '{store.name}''s data plane has access-key connection strings (local auth enabled).'