azure-disk-pmk-read-active

An attacker who can SAS-export a PMK-encrypted or unencrypted managed disk can read the plaintext data immediately upon download (no key gate).

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`BlockStorage`
source	`?principal`
target	`?disk`
permissions	`Microsoft.Compute/disks/beginGetAccess/action`
state logic	ACTIVE: Platform-managed key (PMK) or unencrypted disks require no additional decrypt gate. Azure's platform transparently decrypts the data upon download. The CanExfiltrate edge is the only requirement; plaintext readability is immediate.

source type

Identity

target type

BlockStorage

source

?principal

target

?disk

permissions

Microsoft.Compute/disks/beginGetAccess/action

state logic

ACTIVE: Platform-managed key (PMK) or unencrypted disks require no additional decrypt gate. Azure's platform transparently decrypts the data upon download. The CanExfiltrate edge is the only requirement; plaintext readability is immediate.

Narrative

{principal.name} can download the VHD for disk {target.name} via SAS and read the plaintext data immediately. The disk uses platform-managed encryption (PMK), so Azure decrypts transparently without requiring customer key access.

Raw rule rules/derived/azure/disks.yaml

id: azure-disk-pmk-read-active
emits: CanReadData
description: An attacker who can SAS-export a PMK-encrypted or unencrypted managed disk can read the plaintext
  data immediately upon download (no key gate).
match:
- - principal: null
  - CanExfiltrate
  - disk: null
where:
- node_type(?disk) == BlockStorage
- ?disk.encryption.type in [EncryptionAtRestWithPlatformKey, null/unset]
emit:
  source_type: Identity
  target_type: BlockStorage
  source: ?principal
  target: ?disk
  permissions:
  - Microsoft.Compute/disks/beginGetAccess/action
  conditions: []
  state_logic: 'ACTIVE: Platform-managed key (PMK) or unencrypted disks require no additional decrypt
    gate. Azure''s platform transparently decrypts the data upon download. The CanExfiltrate edge is the
    only requirement; plaintext readability is immediate.'
  confidence: 0.95
  derived_from:
  - <CanExfiltrate edge_id for ?disk>
  false_positive_note: Applies ONLY to disks with encryption.type in [EncryptionAtRestWithPlatformKey,
    null/unset]. Do NOT emit for CMK-encrypted disks (use azure-disk-cmk-gated-read instead). For EncryptionAtRestWithPlatformAndCustomerKeys
    (double encryption), use the CMK rule which gates on the customer key layer.
  narrative: '{principal.name} can download the VHD for disk {target.name} via SAS and read the plaintext
    data immediately. The disk uses platform-managed encryption (PMK), so Azure decrypts transparently
    without requiring customer key access.'