azure-diskencryptionset-write
diskEncryptionSets/write allows changing the Key Vault key reference in a DES, enabling attacker-controlled key wrapping for re-encryption at next attachment.
match (effective permission)
{
"action": "Microsoft.Compute/diskEncryptionSets/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | EncryptionKey |
| source | <principal> |
| target | <disk encryption set> |
| permissions | Microsoft.Compute/diskEncryptionSets/write |
| conditions | service_state |
| state logic | CONDITIONAL(service_state): The attacker can point the DES at a Key Vault key they control, but the re-encryption of disks linked to this DES requires the disk to be reattached/detached on a running VM. When a VM is stopped or detached, this edge is BLOCKED (no re-wrap happens). When the VM is running and a lifecycle operation (attach/detach/VM deallocate) occurs, the edge becomes ACTIVE and the DEK is re-wrapped under the attacker key. |
Narrative
{principal.name} can update the Key Vault key reference in DES {target.name} (diskEncryptionSets/write), allowing re-encryption of attached disks under an attacker-controlled key on the next VM lifecycle event (e.g. reboot or attach).
Raw rule rules/explicit/azure-disks.yaml
id: azure-diskencryptionset-write
emits: CanModifyConfiguration
description: diskEncryptionSets/write allows changing the Key Vault key reference in a DES, enabling attacker-controlled
key wrapping for re-encryption at next attachment.
match_effective_permission:
action: Microsoft.Compute/diskEncryptionSets/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: EncryptionKey
source: <principal>
target: <disk encryption set>
permissions:
- Microsoft.Compute/diskEncryptionSets/write
conditions:
- service_state
state_logic: 'CONDITIONAL(service_state): The attacker can point the DES at a Key Vault key they control,
but the re-encryption of disks linked to this DES requires the disk to be reattached/detached on a
running VM. When a VM is stopped or detached, this edge is BLOCKED (no re-wrap happens). When the
VM is running and a lifecycle operation (attach/detach/VM deallocate) occurs, the edge becomes ACTIVE
and the DEK is re-wrapped under the attacker key.'
false_positive_note: "1) The DES must have at least one disk linked to it (via diskEncryptionSetId).\
\ 2) Re-encryption happens only on VM lifecycle events (attach, detach, VM stop/start). 3) If the\
\ VM is permanently stopped and offline, the re-encryption does not occur\n and the DEK remains\
\ encrypted under the original key -> BLOCKED.\n4) This is a distinct path from CanReadData (decrypt-on-download);\
\ this is\n decrypt-via-rekey (re-encryption in Azure's data plane)."
narrative: '{principal.name} can update the Key Vault key reference in DES {target.name} (diskEncryptionSets/write),
allowing re-encryption of attached disks under an attacker-controlled key on the next VM lifecycle
event (e.g. reboot or attach).'