azure-cosmosdb-cmk-data-read-conditional

Data read on CMK-encrypted Cosmos DB account - BLOCKED state when the Key Vault key is revoked or disabled.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'scope': None}

where

node_class(?scope) == Data and node_type(?scope) == NoSQLDatabase node_type(?scope) matched provider_type in ['Microsoft.DocumentDB/databaseAccounts', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers'] ?principal has EFFECTIVE dataActions Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read AND Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery via sqlRoleAssignment at ?scope ?scope.properties.keyVaultKeyUri is not null and not empty # CMK-encrypted resolved Key Vault key at ?scope.properties.keyVaultKeyUri is disabled or revoked # account is inaccessible

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?scope`
permissions	`Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read` `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery`
conditions	`iam_permission` `key_permission`
state logic	if ?scope.properties.keyVaultKeyUri is set AND the Key Vault key is confirmed-disabled/revoked: BLOCKED (account is inaccessible; the service's MI cannot decrypt data); else this rule does not emit (see azure-cosmosdb-data-reader for normal case). This rule models CMK revocation as a separate capability gate.

Narrative

{principal.name} holds valid data-plane RBAC on {scope.name}, but the account is encrypted with a Customer-Managed Key (CMK) at {scope.properties.keyVaultKeyUri} that is now revoked or disabled in Key Vault. The account is inaccessible - no data can be read regardless of RBAC permissions, because the service's managed identity cannot unwrap the encryption key.

Raw rule rules/derived/azure/cosmosdb.yaml

id: azure-cosmosdb-cmk-data-read-conditional
emits: CanReadData
description: "Data read on CMK-encrypted Cosmos DB account \u2014 BLOCKED state when the Key Vault key\
  \ is revoked or disabled."
match:
- - principal: null
  - HasPermission
  - scope: null
where:
- node_class(?scope) == Data and node_type(?scope) == NoSQLDatabase
- node_type(?scope) matched provider_type in ['Microsoft.DocumentDB/databaseAccounts', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases',
  'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers']
- ?principal has EFFECTIVE dataActions Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
  AND Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery via sqlRoleAssignment
  at ?scope
- '?scope.properties.keyVaultKeyUri is not null and not empty  # CMK-encrypted'
- 'resolved Key Vault key at ?scope.properties.keyVaultKeyUri is disabled or revoked  # account is inaccessible'
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?scope
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery
  conditions:
  - iam_permission
  - key_permission
  state_logic: 'if ?scope.properties.keyVaultKeyUri is set AND the Key Vault key is confirmed-disabled/revoked:
    BLOCKED (account is inaccessible; the service''s MI cannot decrypt data); else this rule does not
    emit (see azure-cosmosdb-data-reader for normal case). This rule models CMK revocation as a separate
    capability gate.'
  confidence: '0.91'
  derived_from:
  - <HasPermission edge_id (sqlRoleAssignment dataActions)>
  - <HasPolicy edge_id (CMK keyVaultKeyUri)>
  false_positive_note: "This rule ONLY emits BLOCKED state \u2014 it handles the specific scenario where\
    \ a principal has valid data-plane RBAC but the account's CMK key has been revoked. Normal data reads\
    \ (CMK key is valid/present) are modeled by azure-cosmosdb-data-reader. Key Vault key revocation/disabled\
    \ state must be observable/confirmed \u2014 do not emit POTENTIAL or guess. The gate resolves via\
    \ key_permission condition linking to credential-chains decrypt-gates-secret-read."
  narrative: "{principal.name} holds valid data-plane RBAC on {scope.name}, but the account is encrypted\
    \ with a Customer-Managed Key (CMK) at {scope.properties.keyVaultKeyUri} that is now revoked or disabled\
    \ in Key Vault. The account is inaccessible \u2014 no data can be read regardless of RBAC permissions,\
    \ because the service's managed identity cannot unwrap the encryption key."