rage.fail

azure-cosmosdb-data-plane-read-permission

explicit azure emits HasPermission

match (record)

{ "field": "properties.roleDefinitionId", "resource_type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments" }

where

resolved roleDefinition.permissions[].dataActions includes Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read AND Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`<principalId of sqlRoleAssignment>`
target	`<databaseAccount or database or container node at sqlRoleAssignment scope>`
permissions	`Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read` `Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery`

Narrative

{principal.name} has a Cosmos DB native data-plane role assignment granting items/read and executeQuery on {account_or_scope.name} (role: {roleDefinition.roleName}).

Raw rule rules/explicit/azure-cosmosdb.yaml

id: azure-cosmosdb-data-plane-read-permission
emits: HasPermission
applies_to:
- azure
match_record:
  resource_type: Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments
  field: properties.roleDefinitionId
where:
- resolved roleDefinition.permissions[].dataActions includes Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
  AND Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: <principalId of sqlRoleAssignment>
  target: <databaseAccount or database or container node at sqlRoleAssignment scope>
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery
  api_source: Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments GET + sqlRoleDefinitions GET
  evidence_field: properties.roleDefinitionId + properties.scope + properties.principalId
  narrative: '{principal.name} has a Cosmos DB native data-plane role assignment granting items/read and
    executeQuery on {account_or_scope.name} (role: {roleDefinition.roleName}).'