azure-appconfig-snapshot-read-kv
snapshots/read returns the key-values frozen in a snapshot, including secret ones.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
HasPermission {'store': None}
{'store': None} Contains {'snapshot': None}
{'snapshot': None} ContainsSecret {'keyvalue': None}
where
node_class(?store) == ManagementService
provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
node_class(?snapshot) == Data # 'Data' is a node CLASS (use node_class), matching the dataplane elsewhere in this file; a snapshot is a Data-class node capturing key-values
?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/snapshots/read at the store scope (Data Reader */read and Data Owner both include it)
node_type(?keyvalue) in [
Secret, ConnectionString, APIKey, Password]
emit
| source | ?principal |
|---|---|
| target | ?keyvalue |
| permissions | Microsoft.AppConfiguration/configurationStores/snapshots/read |
| conditions | iam_permission |
| state logic | ACTIVE when snapshots/read is effective at the store scope. BLOCKED under a deny on the snapshots/read action. No caller key_permission gate (CMK is server-side). |
Narrative
{principal.name} can read snapshot {snapshot.name} of App Configuration store {store.name} (snapshots/read), exposing secret key-value {keyvalue.name}.
Raw rule rules/derived/azure/appconfig.yaml
id: azure-appconfig-snapshot-read-kv
emits: CanReadSecret
description: snapshots/read returns the key-values frozen in a snapshot, including secret ones.
match:
- - principal: null
- HasPermission
- store: null
- - store: null
- Contains
- snapshot: null
- - snapshot: null
- ContainsSecret
- keyvalue: null
where:
- node_class(?store) == ManagementService
- provider_type(?store) == 'Microsoft.AppConfiguration/configurationStores'
- 'node_class(?snapshot) == Data # ''Data'' is a node CLASS (use node_class), matching the dataplane
elsewhere in this file; a snapshot is a Data-class node capturing key-values'
- ?principal has EFFECTIVE Microsoft.AppConfiguration/configurationStores/snapshots/read at the store
scope (Data Reader */read and Data Owner both include it)
- node_type(?keyvalue) in [Secret, ConnectionString, APIKey, Password]
emit:
source: ?principal
target: ?keyvalue
permissions:
- Microsoft.AppConfiguration/configurationStores/snapshots/read
conditions:
- iam_permission
state_logic: ACTIVE when snapshots/read is effective at the store scope. BLOCKED under a deny on the
snapshots/read action. No caller key_permission gate (CMK is server-side).
confidence: '0.85'
derived_from:
- ?principal HasPermission ?store (snapshots/read)
- ?store Contains ?snapshot
- ?snapshot ContainsSecret ?keyvalue
false_positive_note: Only when the snapshot actually captured a secret-bearing key-value. A store with
snapshots but no secret values yields nothing. Do not double-count with the live keyValues/read edge
for the same underlying secret value.
narrative: '{principal.name} can read snapshot {snapshot.name} of App Configuration store {store.name}
(snapshots/read), exposing secret key-value {keyvalue.name}.'