rage.fail

azure-cosmosdb-account-contains-credential

explicit azure emits ContainsCredential

match (record)

{ "field": "properties.disableLocalAuth", "resource_type": "Microsoft.DocumentDB/databaseAccounts" }

where

properties.disableLocalAuth != true # key-based auth enabled (default)

emit

source type	`NoSQLDatabase`
target type	`AccessKey`
source	`<databaseAccount node>`
target	`<primary AccessKey node> and <secondary AccessKey node> and <read-only key nodes>`

Narrative

{account.name} holds primary and secondary master keys and read-only keys. Key-based authentication is enabled (disableLocalAuth=false or unset); these keys bypass all Azure RBAC data-plane role assignments when presented to the data endpoint.

Raw rule rules/explicit/azure-cosmosdb.yaml

id: azure-cosmosdb-account-contains-credential
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.DocumentDB/databaseAccounts
  field: properties.disableLocalAuth
where:
- 'properties.disableLocalAuth != true  # key-based auth enabled (default)'
emit:
  source_type: NoSQLDatabase
  target_type: AccessKey
  source: <databaseAccount node>
  target: <primary AccessKey node> and <secondary AccessKey node> and <read-only key nodes>
  api_source: Microsoft.DocumentDB/databaseAccounts GET
  evidence_field: properties.disableLocalAuth
  narrative: '{account.name} holds primary and secondary master keys and read-only keys. Key-based authentication
    is enabled (disableLocalAuth=false or unset); these keys bypass all Azure RBAC data-plane role assignments
    when presented to the data endpoint.'