azure-cosmosdb-listconnectionstrings-exposes-credential

listConnectionStrings/action returns connection strings embedding the Cosmos DB master keys - equivalent credential exposure to listKeys.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`NoSQLDatabase`
target type	`ConnectionString`
source	`?account`
target	`<ConnectionString node(s) of ?account (embed primary/secondary master keys)>`
permissions	`Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action`
conditions	`iam_permission`
state logic	if deny assignment covers listConnectionStrings/action: BLOCKED; elif ?account.properties.disableLocalAuth == true: CONDITIONAL(service_state) — connection string is retrievable but key-based auth is rejected at data endpoint; else ACTIVE. ARM-plane call — not gated by ipRules or publicNetworkAccess.

source type

NoSQLDatabase

target type

ConnectionString

source

?account

target

<ConnectionString node(s) of ?account (embed primary/secondary master keys)>

permissions

Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action

conditions

iam_permission

state logic

if deny assignment covers listConnectionStrings/action: BLOCKED; elif ?account.properties.disableLocalAuth == true: CONDITIONAL(service_state) — connection string is retrievable but key-based auth is rejected at data endpoint; else ACTIVE. ARM-plane call — not gated by ipRules or publicNetworkAccess.

Narrative

{principal.name} can call listConnectionStrings on {account.name} (Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action), retrieving connection strings that embed the primary and secondary master keys. This provides identical data access as listKeys - full bypass of Azure RBAC data-plane role assignments.

Raw rule rules/derived/azure/cosmosdb.yaml

id: azure-cosmosdb-listconnectionstrings-exposes-credential
emits: ExposesCredential
description: "listConnectionStrings/action returns connection strings embedding the Cosmos DB master keys\
  \ \u2014 equivalent credential exposure to listKeys."
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action at ?account
  scope
emit:
  source_type: NoSQLDatabase
  target_type: ConnectionString
  source: ?account
  target: <ConnectionString node(s) of ?account (embed primary/secondary master keys)>
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action
  conditions:
  - iam_permission
  state_logic: "if deny assignment covers listConnectionStrings/action: BLOCKED; elif ?account.properties.disableLocalAuth\
    \ == true: CONDITIONAL(service_state) \u2014 connection string is retrievable but key-based auth is\
    \ rejected at data endpoint; else ACTIVE. ARM-plane call \u2014 not gated by ipRules or publicNetworkAccess."
  confidence: '0.95'
  derived_from:
  - <HasPermission edge_id (listConnectionStrings/action)>
  false_positive_note: "listConnectionStrings is equivalent to listKeys for attack impact; the connection\
    \ string embeds the master key with the endpoint URI. ARM-plane call \u2014 no network gate applies.\
    \ Cosmos DB Operator's notActions include listConnectionStrings/* \u2014 verify notActions before\
    \ emitting. disableLocalAuth=true: same treatment as listKeys \u2014 key is retrievable, data endpoint\
    \ rejects key-based auth."
  narrative: "{principal.name} can call listConnectionStrings on {account.name} (Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action),\
    \ retrieving connection strings that embed the primary and secondary master keys. This provides identical\
    \ data access as listKeys \u2014 full bypass of Azure RBAC data-plane role assignments."