rage.fail

azure-containerapps-list-secrets

derived azure emits CanReadSecret

match (effective permission)

{ "action": "Microsoft.App/containerApps/listSecrets/action", "scope_type": "resource|resourceGroup|subscription" }

emit

source	`<principal>`
target	`<app secret(s) of the containerApp>`
permissions	`Microsoft.App/containerApps/listSecrets/action`

Narrative

{principal.name} can read the secrets of {target.name} (containerApps/listSecrets/action).

Raw rule rules/derived/azure/containerapps.yaml

id: azure-containerapps-list-secrets
emits: CanReadSecret
match_effective_permission:
  action: Microsoft.App/containerApps/listSecrets/action
  scope_type: resource|resourceGroup|subscription
emit:
  source: <principal>
  target: <app secret(s) of the containerApp>
  permissions:
  - Microsoft.App/containerApps/listSecrets/action
  note: 'Reads configuration.secrets: connection strings, registry passwords, Key Vault references. Feeds
    ExposesCredential when a secret authenticates another identity/service. Microsoft.App/jobs/listSecrets/action
    is the job equivalent.'
  narrative: '{principal.name} can read the secrets of {target.name} (containerApps/listSecrets/action).'