azure-cosmosdb-account-write-modifies-config
databaseAccounts/write allows modifying account properties (disableLocalAuth, firewall, CMK) - enabling configuration attacks such as re-enabling key auth or firewall bypass.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?account) == Data and node_type(?account) ==
NoSQLDatabase
node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/write at ?account scope
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | ?principal |
| target | ?account |
| permissions | Microsoft.DocumentDB/databaseAccounts/write |
| conditions | iam_permission |
| state logic | if deny assignment covers databaseAccounts/write at effective scope: BLOCKED; else ACTIVE. ARM-plane call — not gated by Cosmos DB IP firewall. Downstream consequences include: re-enabling disableLocalAuth (unlocks listKeys data-plane path if previously blocked), firewall policy changes (ExposedToInternet), and CMK key swap (CanAttachIdentity-like escalation for CMK decryption). |
Narrative
{principal.name} has Microsoft.DocumentDB/databaseAccounts/write on {account.name}, allowing modification of account properties. This permits re-enabling key-based authentication (if disabled), changing firewall rules to expose the account to the internet, and swapping the Customer-Managed Key to one they control - unlocking multiple escalation paths to full data access.
Raw rule rules/derived/azure/cosmosdb.yaml
id: azure-cosmosdb-account-write-modifies-config
emits: CanModifyConfiguration
description: "databaseAccounts/write allows modifying account properties (disableLocalAuth, firewall,\
\ CMK) \u2014 enabling configuration attacks such as re-enabling key auth or firewall bypass."
match:
- - principal: null
- HasPermission
- account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/write at ?account scope
emit:
source_type: Identity
target_type: NoSQLDatabase
source: ?principal
target: ?account
permissions:
- Microsoft.DocumentDB/databaseAccounts/write
conditions:
- iam_permission
state_logic: "if deny assignment covers databaseAccounts/write at effective scope: BLOCKED; else ACTIVE.\
\ ARM-plane call \u2014 not gated by Cosmos DB IP firewall. Downstream consequences include: re-enabling\
\ disableLocalAuth (unlocks listKeys data-plane path if previously blocked), firewall policy changes\
\ (ExposedToInternet), and CMK key swap (CanAttachIdentity-like escalation for CMK decryption)."
confidence: '0.89'
derived_from:
- <HasPermission edge_id (databaseAccounts/write)>
false_positive_note: "This is an ARM-plane action not gated by IP firewall. databaseAccounts/write creates\
\ CanModifyConfiguration on the account resource itself. Key downstream effects: (1) disableLocalAuth=false\
\ re-enables key-based auth and unlocks listKeys data paths, (2) firewall changes enable/disable ExposedToInternet,\
\ (3) keyVaultKeyUri changes can swap the account's CMK to a key attacker-controlled. This is high-value\
\ for escalation chaining but typically requires already holding write permission. Do NOT apply network_reachability\
\ \u2014 this is an ARM call."
narrative: "{principal.name} has Microsoft.DocumentDB/databaseAccounts/write on {account.name}, allowing\
\ modification of account properties. This permits re-enabling key-based authentication (if disabled),\
\ changing firewall rules to expose the account to the internet, and swapping the Customer-Managed\
\ Key to one they control \u2014 unlocking multiple escalation paths to full data access."