azure-auto-variable-read
Read a plaintext (non-encrypted) Automation Variable directly from ARM; encrypted variables require runbook execution.
match (effective permission)
{
"action": "Microsoft.Automation/automationAccounts/variables/read",
"scope_type": "resource|resourceGroup|subscription"
}
where
at least one variable in the account has isEncrypted=false
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <plaintext variable (Secret)> |
| permissions | Microsoft.Automation/automationAccounts/variables/read |
| state logic | POTENTIAL when plaintext variables (isEncrypted=false) exist but their credential status cannot be confirmed from ARM metadata alone. ACTIVE when heuristic naming (contains 'password', 'key', 'token', 'secret', 'credential') or content inspection confirms credential material. BLOCKED for encrypted variables (isEncrypted=true) — the value is masked in ARM and requires runbook execution to decrypt. BLOCKED if a deny assignment covers variables/read. |
Narrative
{principal.name} can read plaintext Automation Variables in {source.name} (automationAccounts/variables/read); plaintext variables may contain credential material directly accessible from the ARM API without code execution.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-variable-read
emits: CanReadSecret
description: Read a plaintext (non-encrypted) Automation Variable directly from ARM; encrypted variables
require runbook execution.
match_effective_permission:
action: Microsoft.Automation/automationAccounts/variables/read
scope_type: resource|resourceGroup|subscription
where:
- at least one variable in the account has isEncrypted=false
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <plaintext variable (Secret)>
permissions:
- Microsoft.Automation/automationAccounts/variables/read
conditions: []
state_logic: "POTENTIAL when plaintext variables (isEncrypted=false) exist but their credential status\
\ cannot be confirmed from ARM metadata alone. ACTIVE when heuristic naming (contains 'password',\
\ 'key', 'token', 'secret', 'credential') or content inspection confirms credential material. BLOCKED\
\ for encrypted variables (isEncrypted=true) \u2014 the value is masked in ARM and requires runbook\
\ execution to decrypt. BLOCKED if a deny assignment covers variables/read."
confidence: 0.7
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/variables/read'
- 'credential-chains.yaml: CanReadSecret + CredentialsFor => CanImpersonate'
false_positive_note: Emit for plaintext variables (isEncrypted=false) with moderate confidence (0.70).
Encrypted variables (isEncrypted=true) have their value masked in ARM responses; only code running
inside a runbook (via Get-AutomationVariable) can read encrypted values. Do not emit CanReadSecret
for encrypted variables based on ARM read alone. Use heuristic naming (password, key, token, secret,
credential in the variable name) or confirmed content inspection to upgrade to ACTIVE; otherwise keep
POTENTIAL to surface the capability while allowing analysts to triage.
narrative: '{principal.name} can read plaintext Automation Variables in {source.name} (automationAccounts/variables/read);
plaintext variables may contain credential material directly accessible from the ARM API without code
execution.'