rage.fail

azure-appconfig-reenable-local-auth

explicit azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.AppConfiguration/configurationStores/write", "scope_type": "resource|resourceGroup|subscription" }

where

store currently has disableLocalAuth == true # only meaningful when access keys are DISABLED; if already enabled the connstring path is directly modeled and this is a no-op

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<configuration store node (ManagementService)>`
permissions	`Microsoft.AppConfiguration/configurationStores/write`

Narrative

{principal.name} can re-enable access-key auth on {store.name} (configurationStores/write -> disableLocalAuth=false), regenerating connection strings that read all data. BLOCKED under a deny on configurationStores/write or an Azure Policy enforcing disableLocalAuth=true.

Raw rule rules/explicit/azure-appconfig.yaml

id: azure-appconfig-reenable-local-auth
emits: CanModifyConfiguration
applies_to:
- azure
match_effective_permission:
  action: Microsoft.AppConfiguration/configurationStores/write
  scope_type: resource|resourceGroup|subscription
where:
- 'store currently has disableLocalAuth == true  # only meaningful when access keys are DISABLED; if already
  enabled the connstring path is directly modeled and this is a no-op'
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <configuration store node (ManagementService)>
  api_source: role assignment evaluation (Contributor/Owner) + az appconfig show (properties.disableLocalAuth)
  permissions:
  - Microsoft.AppConfiguration/configurationStores/write
  evidence_field: properties.disableLocalAuth == true
  narrative: '{principal.name} can re-enable access-key auth on {store.name} (configurationStores/write
    -> disableLocalAuth=false), regenerating connection strings that read all data. BLOCKED under a deny
    on configurationStores/write or an Azure Policy enforcing disableLocalAuth=true.'