azure-appconfig-data-reader-read-kv
App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
HasPermission {'store': None}
{'store': None} Contains {'dataplane': None}
{'dataplane': None} ContainsSecret {'keyvalue': None}
where
node_class(?store) == ManagementService
provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
node_class(?dataplane) == Data
?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/keyValues/read at the store scope (App Configuration Data Reader / Data Owner / custom role)
node_type(?keyvalue) in [
Secret, ConnectionString, APIKey, Password]
?keyvalue is a plaintext key-value (contentType is NOT application/vnd.microsoft.appconfig.keyvaultref+json)
emit
| source | ?principal |
|---|---|
| target | ?keyvalue |
| permissions | Microsoft.AppConfiguration/configurationStores/keyValues/read |
| conditions | iam_permission |
| state logic | ACTIVE when the effective keyValues/read is granted at the store scope and access to the key-value is not denied. CMK on the store does NOT add a key_permission gate (server-side transparent decrypt). BLOCKED if a deny assignment / deny (Azure Policy) neutralizes keyValues/read at the scope. |
Narrative
{principal.name} can read key-value {keyvalue.name} in App Configuration store {store.name} (keyValues/read); its value is credential material.
Raw rule rules/derived/azure/appconfig.yaml
id: azure-appconfig-data-reader-read-kv
emits: CanReadSecret
description: App Configuration Data Reader (keyValues/read) can read a key-value that holds credential
material.
match:
- - principal: null
- HasPermission
- store: null
- - store: null
- Contains
- dataplane: null
- - dataplane: null
- ContainsSecret
- keyvalue: null
where:
- node_class(?store) == ManagementService
- provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
- node_class(?dataplane) == Data
- ?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/keyValues/read at the store
scope (App Configuration Data Reader / Data Owner / custom role)
- node_type(?keyvalue) in [Secret, ConnectionString, APIKey, Password]
- ?keyvalue is a plaintext key-value (contentType is NOT application/vnd.microsoft.appconfig.keyvaultref+json)
emit:
source: ?principal
target: ?keyvalue
permissions:
- Microsoft.AppConfiguration/configurationStores/keyValues/read
conditions:
- iam_permission
state_logic: ACTIVE when the effective keyValues/read is granted at the store scope and access to the
key-value is not denied. CMK on the store does NOT add a key_permission gate (server-side transparent
decrypt). BLOCKED if a deny assignment / deny (Azure Policy) neutralizes keyValues/read at the scope.
confidence: '0.9'
derived_from:
- ?principal HasPermission ?store (keyValues/read)
- ?store Contains ?dataplane
- ?dataplane ContainsSecret ?keyvalue
false_positive_note: "Only emit when the key-value's value is genuinely credential material (connection\
\ string, client secret, API key) \u2014 feature flags / plain config are NOT secrets and must not\
\ yield CanReadSecret. Do NOT emit for Key-Vault-reference key-values (their value is a URI, not the\
\ secret \u2014 see azure-appconfig-kv-reference). Do NOT add a caller CanDecrypt/key_permission condition\
\ for CMK-encrypted stores: App Configuration decrypts server-side for any authorized reader."
narrative: '{principal.name} can read key-value {keyvalue.name} in App Configuration store {store.name}
(keyValues/read); its value is credential material.'