rage.fail

azure-appconfig-keyvalue-credentials-for

explicit azure emits CredentialsFor

match (record)

{ "field": "value", "resource_type": "Microsoft.AppConfiguration/configurationStores/keyValues" }

where

value is credential material AND its target identity/resource is resolvable (SP appId+secret, storage/SQL/Service Bus connection string, API key bound to a known service)

emit

source	`<key-value Secret/ConnectionString node>`
target	`<resolved identity / data plane it authenticates to>`

Narrative

Key-value {keyvalue.name} is credentials for {target.name}.

Raw rule rules/explicit/azure-appconfig.yaml

id: azure-appconfig-keyvalue-credentials-for
emits: CredentialsFor
applies_to:
- azure
match_record:
  resource_type: Microsoft.AppConfiguration/configurationStores/keyValues
  field: value
where:
- value is credential material AND its target identity/resource is resolvable (SP appId+secret, storage/SQL/Service
  Bus connection string, API key bound to a known service)
emit:
  source: <key-value Secret/ConnectionString node>
  target: <resolved identity / data plane it authenticates to>
  api_source: az appconfig kv list (value parse)
  evidence_field: value
  narrative: Key-value {keyvalue.name} is credentials for {target.name}.