azure-cosmosdb-data-contributor-write

Cosmos DB Built-in Data Contributor (or custom role with items/*) grants data-plane write - enabling item creation, replacement, upsert, and deletion.

derived azure emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'account': None}

where

node_class(?account) == Data and node_type(?account) == NoSQLDatabase node_type(?account) matched provider_type in ['Microsoft.DocumentDB/databaseAccounts', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers'] ?principal has EFFECTIVE dataActions Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create OR items/replace OR items/upsert via sqlRoleAssignment at ?account or database or container scope (Cosmos DB Built-in Data Contributor 00000000-0000-0000-0000-000000000002 or custom role)

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?account`
permissions	`Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create` `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/replace` `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/upsert`
conditions	`iam_permission` `network_reachability`
state logic	if network controls block the principal: CONDITIONAL(network_reachability); elif deny assignment covers the sqlRoleAssignment: BLOCKED; else ACTIVE.

Narrative

{principal.name} can write to containers in {account.name} (Cosmos DB Built-in Data Contributor or custom role with write dataActions), enabling creation, replacement, or upsert of items. Items consumed by downstream application logic (config, ML features, session state) may be poisoned to influence application behavior.

Raw rule rules/derived/azure/cosmosdb.yaml

id: azure-cosmosdb-data-contributor-write
emits: CanWriteData
description: "Cosmos DB Built-in Data Contributor (or custom role with items/*) grants data-plane write\
  \ \u2014 enabling item creation, replacement, upsert, and deletion."
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type in ['Microsoft.DocumentDB/databaseAccounts', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases',
  'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers']
- ?principal has EFFECTIVE dataActions Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create
  OR items/replace OR items/upsert via sqlRoleAssignment at ?account or database or container scope (Cosmos
  DB Built-in Data Contributor 00000000-0000-0000-0000-000000000002 or custom role)
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/replace
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/upsert
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if network controls block the principal: CONDITIONAL(network_reachability); elif deny
    assignment covers the sqlRoleAssignment: BLOCKED; else ACTIVE.'
  confidence: '0.85'
  derived_from:
  - <HasPermission edge_id (sqlRoleAssignment dataActions write)>
  false_positive_note: "CanWriteData alone has limited escalation value; its attack utility is realized\
    \ when the target Cosmos DB items are consumed by downstream application logic (e.g., config records,\
    \ ML feature store entries, session data) \u2014 poisoning those items can influence application behavior\
    \ or privilege decisions. Apply network_reachability gate as with CanReadData. Cosmos DB does not\
    \ support write-immutability policies analogous to blob WORM \u2014 CanWriteData is always structurally\
    \ possible if the data-plane permission exists."
  narrative: '{principal.name} can write to containers in {account.name} (Cosmos DB Built-in Data Contributor
    or custom role with write dataActions), enabling creation, replacement, or upsert of items. Items
    consumed by downstream application logic (config, ML features, session state) may be poisoned to influence
    application behavior.'