azure-cosmosdb-sqlrole-self-grant

id: azure-cosmosdb-sqlrole-self-grant
emits: CanModifyPolicy
description: "sqlRoleAssignments/write allows modifying Cosmos DB's native data-plane RBAC policy via\
  \ role assignment creation/updates \u2014 enabling privilege escalation by assigning high-privilege\
  \ roles to oneself."
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?principal has EFFECTIVE Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write at ?account
  scope
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write
  conditions:
  - iam_permission
  state_logic: "if deny assignment covers sqlRoleAssignments/write at effective scope: BLOCKED; else ACTIVE.\
    \ ARM-plane call \u2014 not gated by Cosmos DB IP firewall. The downstream capability (CanReadData\
    \ or CanWriteData) that results from the role assignment mutation IS gated by network_reachability\
    \ when the role is exercised at the data plane."
  confidence: '0.88'
  derived_from:
  - <HasPermission edge_id (sqlRoleAssignments/write)>
  false_positive_note: "CanModifyPolicy is emitted for the ARM sqlRoleAssignments/write action; the principal\
    \ can modify Cosmos DB's native data-plane RBAC policy by creating/updating role assignments. This\
    \ is distinct from Azure's standard CanGrantPermission (Microsoft.Authorization/roleAssignments/write),\
    \ which operates on ARM RBAC. The actual data-plane access (CanReadData/CanWriteData) follows from\
    \ the assigned role and is gated by network_reachability when exercised. This is an ARM-plane call\
    \ not gated by the Cosmos DB IP firewall. Cosmos DB Operator (230815da-be43-4aae-9cb4-875f7bd000aa)\
    \ is documented to have sqlRoleAssignments/write in its notActions list \u2014 verify this against\
    \ the official Microsoft RBAC permissions reference (https://learn.microsoft.com/azure/role-based-access-control/built-in-roles)\
    \ before accepting the suppression on Cosmos DB Operator assignments. A self-grant of Cosmos DB Built-in\
    \ Data Contributor enables items/read + items/* (full CRUD), which chains into azure-cosmosdb-data-reader\
    \ and azure-cosmosdb-data-contributor-write after assignment creation. The sqlRoleAssignment/write\
    \ itself requires sqlRoleDefinitions/read to identify available role IDs \u2014 verify that permission\
    \ is also present, but do not block the CanModifyPolicy emit on its absence since Contributor/Owner\
    \ implies both."
  narrative: "{principal.name} has Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write on {account.name},\
    \ allowing it to create or update Cosmos DB native data-plane role assignments. By modifying the account's\
    \ RBAC policy, it can grant itself the Cosmos DB Built-in Data Contributor role, gaining full data-plane\
    \ read/write access without calling listKeys \u2014 a privilege escalation via policy modification."