azure-cosmosdb-data-plane-write-permission
match (record)
{
"field": "properties.roleDefinitionId",
"resource_type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments"
}
where
resolved roleDefinition.permissions[].dataActions includes (Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create OR Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/replace OR Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/upsert)
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principalId of sqlRoleAssignment> |
| target | <databaseAccount or database or container node at sqlRoleAssignment scope> |
| permissions | Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/replace Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/upsert |
Narrative
{principal.name} has a Cosmos DB native data-plane role assignment granting write (create/replace/upsert) on {account_or_scope.name} (role: {roleDefinition.roleName}).
Raw rule rules/explicit/azure-cosmosdb.yaml
id: azure-cosmosdb-data-plane-write-permission
emits: HasPermission
applies_to:
- azure
match_record:
resource_type: Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments
field: properties.roleDefinitionId
where:
- resolved roleDefinition.permissions[].dataActions includes (Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create
OR Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/replace OR Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/upsert)
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principalId of sqlRoleAssignment>
target: <databaseAccount or database or container node at sqlRoleAssignment scope>
permissions:
- Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/create
- Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/replace
- Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/upsert
api_source: Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments GET + sqlRoleDefinitions GET
evidence_field: properties.roleDefinitionId + properties.scope + properties.principalId
narrative: '{principal.name} has a Cosmos DB native data-plane role assignment granting write (create/replace/upsert)
on {account_or_scope.name} (role: {roleDefinition.roleName}).'