rage.fail

azure-appconfig-keyvalue-kv-reference

explicit azure emits ContainsResourceReference

match (record)

{ "field": "contentType", "resource_type": "Microsoft.AppConfiguration/configurationStores/keyValues" }

where

contentType == 'application/vnd.microsoft.appconfig.keyvaultref+json'

emit

target type	`*`
source	`<key-value node>`
target	`<external Key Vault Secret node (from value URI)>`

Narrative

Key-value {keyvalue.name} is a Key Vault reference to {kvsecret.name} (URI, not the secret itself).

Raw rule rules/explicit/azure-appconfig.yaml

id: azure-appconfig-keyvalue-kv-reference
emits: ContainsResourceReference
applies_to:
- azure
match_record:
  resource_type: Microsoft.AppConfiguration/configurationStores/keyValues
  field: contentType
where:
- contentType == 'application/vnd.microsoft.appconfig.keyvaultref+json'
emit:
  target_type: '*'
  source: <key-value node>
  target: <external Key Vault Secret node (from value URI)>
  api_source: az appconfig kv list
  evidence_field: value (Key Vault secret URI)
  narrative: Key-value {keyvalue.name} is a Key Vault reference to {kvsecret.name} (URI, not the secret
    itself).