rage.fail

azure-cosmosdb-cmk-property

explicit azure emits HasPolicy

match (record)

{ "field": "properties.keyVaultKeyUri", "resource_type": "Microsoft.DocumentDB/databaseAccounts" }

where

properties.keyVaultKeyUri is not null and not empty

emit

source type	`NoSQLDatabase`
target type	`Policy`
source	`<databaseAccount node>`
target	`<CMK EncryptionKey ResourcePolicy node>`

Narrative

{account.name} uses customer-managed keys (CMK) with Key Vault key {properties.keyVaultKeyUri}. All stored data is encrypted with this key. Revoking the key makes the account inaccessible.

Raw rule rules/explicit/azure-cosmosdb.yaml

id: azure-cosmosdb-cmk-property
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.DocumentDB/databaseAccounts
  field: properties.keyVaultKeyUri
where:
- properties.keyVaultKeyUri is not null and not empty
emit:
  source_type: NoSQLDatabase
  target_type: Policy
  source: <databaseAccount node>
  target: <CMK EncryptionKey ResourcePolicy node>
  api_source: Microsoft.DocumentDB/databaseAccounts GET
  evidence_field: properties.keyVaultKeyUri
  narrative: '{account.name} uses customer-managed keys (CMK) with Key Vault key {properties.keyVaultKeyUri}.
    All stored data is encrypted with this key. Revoking the key makes the account inaccessible.'