rage.fail

azure-appconfig-keyvalue-is-secret

explicit azure emits ContainsSecret

match (record)

{ "field": "value", "resource_type": "Microsoft.AppConfiguration/configurationStores/keyValues" }

where

contentType != 'application/vnd.microsoft.appconfig.keyvaultref+json' value is classified credential material (connection-string pattern, client-secret/appId pairing, API-key heuristic)

emit

source	`<store data-plane node (class Data)>`
target	`<key-value Secret/ConnectionString node>`

Narrative

{store.name}'s data plane holds secret key-value {keyvalue.name} (its value is credential material).

Raw rule rules/explicit/azure-appconfig.yaml

id: azure-appconfig-keyvalue-is-secret
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Microsoft.AppConfiguration/configurationStores/keyValues
  field: value
where:
- contentType != 'application/vnd.microsoft.appconfig.keyvaultref+json'
- value is classified credential material (connection-string pattern, client-secret/appId pairing, API-key
  heuristic)
emit:
  source: <store data-plane node (class Data)>
  target: <key-value Secret/ConnectionString node>
  api_source: az appconfig kv list
  evidence_field: value + contentType
  narrative: '{store.name}''s data plane holds secret key-value {keyvalue.name} (its value is credential
    material).'