azure-cosmosdb-listkeys-exposes-credential

listKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network controls.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'account': None}

where

node_class(?account) == Data and node_type(?account) == NoSQLDatabase node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts' ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/listKeys/action at ?account scope NOTE: Cosmos DB Operator (230815da) has listKeys/* in notActions — verify effective permission excludes notActions; do NOT emit for Cosmos DB Operator assignments

emit

source type	`NoSQLDatabase`
target type	`AccessKey`
source	`?account`
target	`<primary/secondary AccessKey node(s) of ?account>`
permissions	`Microsoft.DocumentDB/databaseAccounts/listKeys/action`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy explicitly covers listKeys/action at the effective scope: BLOCKED; elif ?account.properties.disableLocalAuth == true: CONDITIONAL(service_state) — the key is retrievable via ARM but cannot authenticate to the data endpoint; else ACTIVE. CRITICAL: the Cosmos DB IP firewall (ipRules/publicNetworkAccess) gates the DATA-PLANE endpoint, NOT the ARM listKeys call. listKeys succeeds over management.azure.com from any network regardless of ipRules. Do NOT apply network_reachability here.

Narrative

{principal.name} can call listKeys on {account.name} (Microsoft.DocumentDB/databaseAccounts/listKeys/action), retrieving the primary and secondary master keys. These keys bypass all Azure RBAC data-plane role assignments and authenticate directly to every database and container in the account, granting full read, write, and delete access regardless of IP firewall configuration.

Raw rule rules/derived/azure/cosmosdb.yaml

id: azure-cosmosdb-listkeys-exposes-credential
emits: ExposesCredential
description: listKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network
  controls.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/listKeys/action at ?account scope
- "NOTE: Cosmos DB Operator (230815da) has listKeys/* in notActions \u2014 verify effective permission\
  \ excludes notActions; do NOT emit for Cosmos DB Operator assignments"
emit:
  source_type: NoSQLDatabase
  target_type: AccessKey
  source: ?account
  target: <primary/secondary AccessKey node(s) of ?account>
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/listKeys/action
  conditions:
  - iam_permission
  state_logic: "if a deny assignment or deny Azure Policy explicitly covers listKeys/action at the effective\
    \ scope: BLOCKED; elif ?account.properties.disableLocalAuth == true: CONDITIONAL(service_state) \u2014\
    \ the key is retrievable via ARM but cannot authenticate to the data endpoint; else ACTIVE. CRITICAL:\
    \ the Cosmos DB IP firewall (ipRules/publicNetworkAccess) gates the DATA-PLANE endpoint, NOT the ARM\
    \ listKeys call. listKeys succeeds over management.azure.com from any network regardless of ipRules.\
    \ Do NOT apply network_reachability here."
  confidence: '0.97'
  derived_from:
  - <HasPermission edge_id (listKeys/action)>
  false_positive_note: "listKeys is an ARM control-plane call not gated by the Cosmos DB IP firewall or\
    \ publicNetworkAccess setting. Do NOT apply network_reachability. Verify the effective permission\
    \ excludes Cosmos DB Operator's notActions \u2014 that role explicitly blocks listKeys. When disableLocalAuth=true,\
    \ the key material is still readable over ARM but the data endpoint rejects key-based auth; emit with\
    \ CONDITIONAL(service_state) for the full-exfiltrate path, but ExposesCredential itself is ACTIVE\
    \ (the key is accessible). ContainsCredential(account -> AccessKey) is the structural fact; this rule\
    \ derives the ExposesCredential capability edge."
  narrative: '{principal.name} can call listKeys on {account.name} (Microsoft.DocumentDB/databaseAccounts/listKeys/action),
    retrieving the primary and secondary master keys. These keys bypass all Azure RBAC data-plane role
    assignments and authenticate directly to every database and container in the account, granting full
    read, write, and delete access regardless of IP firewall configuration.'