azure-batch-config-secrets
Pool startTask / job env settings / resource-file SAS URLs frequently embed secrets, readable at Reader level.
match (effective permission)
{
"action": "Microsoft.Batch/batchAccounts/pools/read",
"scope_type": "resource|resourceGroup|subscription"
}
where
pool startTask.environmentSettings, job env, or resource-file httpUrl (SAS) contains credential material
emit
| source | <batchAccount/pool> |
|---|---|
| target | <embedded credential> |
| permissions | Microsoft.Batch/batchAccounts/pools/read |
Narrative
{pool.name} exposes a credential in its startTask environment / resource-file SAS URL, readable with pools/read.
Raw rule rules/derived/azure/batch.yaml
id: azure-batch-config-secrets
emits: ExposesCredential
description: Pool startTask / job env settings / resource-file SAS URLs frequently embed secrets, readable
at Reader level.
match_effective_permission:
action: Microsoft.Batch/batchAccounts/pools/read
scope_type: resource|resourceGroup|subscription
where:
- pool startTask.environmentSettings, job env, or resource-file httpUrl (SAS) contains credential material
emit:
source: <batchAccount/pool>
target: <embedded credential>
permissions:
- Microsoft.Batch/batchAccounts/pools/read
false_positive_note: Only emit when a secret is actually present in env settings / resource-file SAS;
presence of the read permission alone is recon, not credential exposure.
narrative: '{pool.name} exposes a credential in its startTask environment / resource-file SAS URL, readable
with pools/read.'