azure-cosmosdb-data-reader

id: azure-cosmosdb-data-reader
emits: CanReadData
description: Cosmos DB Built-in Data Reader (or custom role with items/read + executeQuery) grants effective
  data-plane read of items and query execution.
match:
- - principal: null
  - HasPermission
  - scope: null
where:
- node_class(?scope) == Data and node_type(?scope) == NoSQLDatabase
- node_type(?scope) matched provider_type in ['Microsoft.DocumentDB/databaseAccounts', 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases',
  'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers']
- ?principal has EFFECTIVE dataActions Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
  AND Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery via sqlRoleAssignment
  at ?scope (Cosmos DB Built-in Data Reader 00000000-0000-0000-0000-000000000001 or custom role)
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?scope
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
  - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/executeQuery
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "if ?scope.properties.publicNetworkAccess == 'Disabled' AND no private endpoint provides\
    \ a path from ?principal to ?scope: CONDITIONAL(network_reachability); elif ?scope.properties.ipRules\
    \ is non-empty AND ?principal is not within the allowed IP/CIDR ranges AND no VNet service endpoint\
    \ allows the source: CONDITIONAL(network_reachability); elif deny assignment covers the sqlRoleAssignment\
    \ at effective scope: BLOCKED; else ACTIVE. NOTE on CMK: Cosmos DB's CMK is account-level and managed\
    \ by the service's MI. An attacker reading via data-plane RBAC gets plaintext items (the service decrypts\
    \ transparently). When the CMK key is revoked/disabled in Key Vault, the account becomes inaccessible\
    \ \u2014 this gate is handled by azure-cosmosdb-cmk-data-read-conditional."
  confidence: '0.88'
  derived_from:
  - <HasPermission edge_id (sqlRoleAssignment dataActions)>
  false_positive_note: "This is a data-plane action gated by the Cosmos DB IP firewall (ipRules) and publicNetworkAccess,\
    \ unlike the ARM-plane listKeys. Apply CONDITIONAL(network_reachability) when the account has IP rules\
    \ or publicNetworkAccess=Disabled and no private endpoint path exists. Native data-plane RBAC is separate\
    \ from ARM RBAC \u2014 Subscription Owner cannot execute queries without a sqlRoleAssignment (unless\
    \ using listKeys). Scope matters: a Built-in Data Reader assignment on a specific container targets\
    \ that container only. For CMK-revoked accounts, see azure-cosmosdb-cmk-data-read-conditional."
  narrative: "{principal.name} holds a native Cosmos DB data-plane role assignment granting items/read\
    \ + executeQuery on {scope.name}. They can execute NoSQL queries and perform point reads on items\
    \ within the assigned scope. Items may contain embedded credentials, connection strings, or API keys\
    \ \u2014 see credential-chains.yaml for ContainsSecret -> CredentialsFor -> CanImpersonate roll-up\
    \ when containers store credential material."