azure-arm-deploymentscript-env-vars
Principal with deploymentScripts/read can retrieve plaintext values from the script's environmentVariables array if credentials are passed inline.
match (effective permission)
{
"action": "Microsoft.Resources/deploymentScripts/read",
"scope_type": "resource|resourceGroup|subscription"
}
where
the deploymentScript resource has environmentVariables entries with plaintext value fields carrying credential material
(not secureValue or Key Vault references — those are redacted/opaque)
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <credential / secret in deploymentScript environmentVariables> |
| permissions | Microsoft.Resources/deploymentScripts/read |
| conditions | iam_permission |
| state logic | ACTIVE when the principal holds deploymentScripts/read AND the environmentVariables array contains plaintext credential values in `value` fields (not Key Vault secret references, which are opaque at read-time; not secureValue, which is redacted). CONDITIONAL(iam_permission) if the content of environmentVariables has not been confirmed to carry readable credentials. BLOCKED if a deny assignment covers deploymentScripts/read. |
Narrative
{principal.name} can read the deploymentScript {target.name} resource definition (deploymentScripts/read) and retrieve plaintext credential values stored in its environmentVariables array (plaintext `value` fields only) - an indirect credential harvest if the script was configured with inline secrets.
Raw rule rules/derived/azure/arm-deployments.yaml
id: azure-arm-deploymentscript-env-vars
emits: CanReadSecret
description: Principal with deploymentScripts/read can retrieve plaintext values from the script's environmentVariables
array if credentials are passed inline.
match_effective_permission:
action: Microsoft.Resources/deploymentScripts/read
scope_type: resource|resourceGroup|subscription
where:
- the deploymentScript resource has environmentVariables entries with plaintext value fields carrying
credential material
- "(not secureValue or Key Vault references \u2014 those are redacted/opaque)"
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <credential / secret in deploymentScript environmentVariables>
permissions:
- Microsoft.Resources/deploymentScripts/read
conditions:
- iam_permission
state_logic: ACTIVE when the principal holds deploymentScripts/read AND the environmentVariables array
contains plaintext credential values in `value` fields (not Key Vault secret references, which are
opaque at read-time; not secureValue, which is redacted). CONDITIONAL(iam_permission) if the content
of environmentVariables has not been confirmed to carry readable credentials. BLOCKED if a deny assignment
covers deploymentScripts/read.
false_positive_note: "`secureValue` fields are REDACTED in ARM GET responses per Azure documentation\
\ and the ARM API does NOT return the value \u2014 they are masked like secureString parameters. Do\
\ NOT emit CanReadSecret for secureValue entries from this rule; only emit for confirmed plaintext\
\ `value` fields containing inline credential strings. Key Vault secret references in environmentVariables\
\ appear as opaque references at ARM read-time (e.g., `/subscriptions/...`); the resolved secret value\
\ is only available inside the running ACI container. Do NOT emit CanReadSecret for KV-reference env\
\ vars from this rule."
narrative: "{principal.name} can read the deploymentScript {target.name} resource definition (deploymentScripts/read)\
\ and retrieve plaintext credential values stored in its environmentVariables array (plaintext `value`\
\ fields only) \u2014 an indirect credential harvest if the script was configured with inline secrets."
derived_from:
- <deploymentScripts/read effective permission>
- 'credential-chains.yaml: read-secret-yields-identity (cited for downstream pivot)'