azure-appconfig-data-owner-read-kv
App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
HasPermission {'store': None}
{'store': None} Contains {'dataplane': None}
{'dataplane': None} ContainsSecret {'keyvalue': None}
where
node_class(?store) == ManagementService
provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
node_class(?dataplane) == Data
?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/*/read (App Configuration Data Owner) OR configurationStores/*/action at the store scope
node_type(?keyvalue) in [
Secret, ConnectionString, APIKey, Password]
?keyvalue is a plaintext key-value (not a keyvaultref)
emit
| source | ?principal |
|---|---|
| target | ?keyvalue |
| permissions | Microsoft.AppConfiguration/configurationStores/keyValues/read |
| conditions | iam_permission |
| state logic | ACTIVE when Data Owner (or a custom role granting configurationStores/*/read) is effective at the store scope. BLOCKED under a deny assignment / deny policy on the read action. |
Narrative
{principal.name} is App Configuration Data Owner on {store.name} and can read secret key-value {keyvalue.name} (keyValues/read).
Raw rule rules/derived/azure/appconfig.yaml
id: azure-appconfig-data-owner-read-kv
emits: CanReadSecret
description: App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.
match:
- - principal: null
- HasPermission
- store: null
- - store: null
- Contains
- dataplane: null
- - dataplane: null
- ContainsSecret
- keyvalue: null
where:
- node_class(?store) == ManagementService
- provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
- node_class(?dataplane) == Data
- ?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/*/read (App Configuration Data
Owner) OR configurationStores/*/action at the store scope
- node_type(?keyvalue) in [Secret, ConnectionString, APIKey, Password]
- ?keyvalue is a plaintext key-value (not a keyvaultref)
emit:
source: ?principal
target: ?keyvalue
permissions:
- Microsoft.AppConfiguration/configurationStores/keyValues/read
conditions:
- iam_permission
state_logic: ACTIVE when Data Owner (or a custom role granting configurationStores/*/read) is effective
at the store scope. BLOCKED under a deny assignment / deny policy on the read action.
confidence: '0.9'
derived_from:
- ?principal HasPermission ?store (*/read via Data Owner)
- ?store Contains ?dataplane
- ?dataplane ContainsSecret ?keyvalue
false_positive_note: Redundant with azure-appconfig-data-reader-read-kv when both roles resolve to keyValues/read;
deduped by (type,source,target,scope). Same secret-vs-config classification and KV-reference exclusion
apply. No caller key_permission gate.
narrative: '{principal.name} is App Configuration Data Owner on {store.name} and can read secret key-value
{keyvalue.name} (keyValues/read).'