azure-cognitivesearch-list-query-keys

id: azure-cognitivesearch-list-query-keys
emits: ExposesCredential
description: The search service exposes one or more query API keys (discoverable via listQueryKeys/action
  by principals holding Search Service Contributor, Contributor, or Owner roles). Query keys grant read-only
  data-plane access (search, suggest, autocomplete queries against all indexes).
match:
- - service: null
  - null: null
  - querykey: null
where:
- node_class(?service) == Data and node_type(?service) == SearchService
- ?service.provider_type == 'Microsoft.Search/searchServices'
- node_class(?querykey) == Secret and node_type(?querykey) == APIKey
- ?querykey.properties.scope == 'query' OR tag(?querykey, 'key-type') == 'query'
- '?service.properties.disableLocalAuth != true  # keys are disabled when disableLocalAuth is true; do
  not emit if flag is set'
emit:
  source_type: Data
  target_type: Secret
  source: ?service
  target: ?querykey
  permissions:
  - Microsoft.Search/searchServices/listQueryKeys/action
  conditions:
  - iam_permission
  state_logic: "ACTIVE when ?service exists, ?querykey is materialized from listQueryKeys API response,\
    \ and disableLocalAuth == false. BLOCKED if disableLocalAuth == true (keys are server-side disabled).\
    \ CONDITIONAL(service_state) if service state is unknown or disableLocalAuth is unknown/unresolved.\
    \ Treat disableLocalAuth absent or null as equivalent to false (Azure default: keys enabled). This\
    \ edge models the service exposing its query key credential \u2014 it does not depend on network reachability\
    \ (ARM plane is reachable from any network that can reach management.azure.com)."
  confidence: 0.88
  derived_from:
  - "Collector normalization: Microsoft.Search/searchServices/listQueryKeys/action \u2192 APIKey node"
  - ?service.properties.disableLocalAuth == false (or not set, per Azure default)
  false_positive_note: "CRITICAL gate: if ?service.properties.disableLocalAuth == true, query keys are\
    \ inactive and cannot authenticate to the data plane \u2014 do NOT emit. Do not emit if ?querykey.properties.scope\
    \ != 'query' or the key is inferred rather than explicitly materialized. Query keys are read-only\
    \ and do not grant index management or document write permissions \u2014 but both admin and query\
    \ key holders can read all indexed documents (CanReadData)."
  narrative: 'Search service {service.name} exposes query API keys via the listQueryKeys action. Any principal
    holding Microsoft.Search/searchServices/listQueryKeys/action (granted by Search Service Contributor,
    Contributor, or Owner) can retrieve these keys. Query keys grant read-only data-plane access: search,
    suggest, and autocomplete queries against all indexes, reading the full content of matching documents.
    Indexed documents may contain PII, secrets, or other sensitive data ingested from connected data sources.'