azure-batch-listkeys
match (effective permission)
{
"any_of": [
{
"action": "Microsoft.Batch/batchAccounts/listkeys/action",
"scope_type": "resource|resourceGroup|subscription"
},
{
"action": "Microsoft.Batch/batchAccounts/regeneratekeys/action",
"scope_type": "resource|resourceGroup|subscription"
}
]
}
emit
| source | <principal> |
|---|---|
| target | <Batch account shared keys (AccessKey)> |
| permissions | Microsoft.Batch/batchAccounts/listkeys/action Microsoft.Batch/batchAccounts/regeneratekeys/action |
| state logic | ACTIVE via listkeys/action OR regeneratekeys/action; regeneratekeys/action ALONE is sufficient because regenerating a key returns the new key value, so a principal with only regeneratekeys (and no listkeys) still obtains a usable shared key. |
Narrative
{principal.name} can retrieve or regenerate the shared keys of Batch account {target.name} (batchAccounts/listkeys/action or regeneratekeys/action) and authenticate to the data plane.
Raw rule rules/derived/azure/batch.yaml
id: azure-batch-listkeys
emits: CanReadSecret
match_effective_permission:
any_of:
- action: Microsoft.Batch/batchAccounts/listkeys/action
scope_type: resource|resourceGroup|subscription
- action: Microsoft.Batch/batchAccounts/regeneratekeys/action
scope_type: resource|resourceGroup|subscription
emit:
source: <principal>
target: <Batch account shared keys (AccessKey)>
permissions:
- Microsoft.Batch/batchAccounts/listkeys/action
- Microsoft.Batch/batchAccounts/regeneratekeys/action
note: Primary/secondary keys authenticate to the data plane (<account>.<region>.batch.azure.com) to
submit jobs/tasks.
state_logic: ACTIVE via listkeys/action OR regeneratekeys/action; regeneratekeys/action ALONE is sufficient
because regenerating a key returns the new key value, so a principal with only regeneratekeys (and
no listkeys) still obtains a usable shared key.
false_positive_note: 'listkeys/regeneratekeys yield DATA-plane keys only; neither lets the holder change
a pool identity block (management-plane + Entra only). regeneratekeys/action alone is a credential-access
primitive: it returns the regenerated key value (and rotates the old one). It escalates to execution
only when an identity-bearing pool already exists to submit tasks into.'
narrative: '{principal.name} can retrieve or regenerate the shared keys of Batch account {target.name}
(batchAccounts/listkeys/action or regeneratekeys/action) and authenticate to the data plane.'