azure-eh-data-receiver
Azure Event Hubs Data Receiver role (or equivalent) grants receive (listen) access to an event hub or consumer group; event payloads may contain sensitive data → potential CanExfiltrate.
match (effective permission)
{
"action": "Microsoft.EventHub/namespaces/eventhubs/messages/receive/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Azure Event Hubs Data Receiver, Azure Event Hubs Data Owner, or a custom role granting receive permission on the event hub or consumer group
emit
| source type | Identity |
|---|---|
| target type | Queue |
| source | <principal> |
| target | <event hub (Queue node)> |
| permissions | Microsoft.EventHub/namespaces/eventhubs/messages/receive/action |
| conditions | service_state |
| state logic | ACTIVE when the principal holds the effective receive permission AND the namespace is not suspended. BLOCKED if a deny assignment covers the receive action. The escalation consequence (CanExfiltrate) is produced by the data-plane rules: CanReadData(p, hub) where events carry sensitive payloads → CanExfiltrate (cited, not re-derived here). CanReadData alone is data-plane access, not identity escalation. |
Narrative
{principal.name} can receive (consume) events from event hub {target.name} (Azure Event Hubs Data Receiver / messages/receive/action). If event payloads carry sensitive content (connection strings, tokens, PII), this yields CanExfiltrate via the data-plane rules.
Raw rule rules/derived/azure/eventhubs.yaml
id: azure-eh-data-receiver
emits: CanReadData
description: "Azure Event Hubs Data Receiver role (or equivalent) grants receive (listen) access to an\
\ event hub or consumer group; event payloads may contain sensitive data \u2192 potential CanExfiltrate."
match_effective_permission:
action: Microsoft.EventHub/namespaces/eventhubs/messages/receive/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Azure Event Hubs Data Receiver, Azure Event Hubs Data Owner, or a custom
role granting receive permission on the event hub or consumer group
emit:
source_type: Identity
target_type: Queue
source: <principal>
target: <event hub (Queue node)>
permissions:
- Microsoft.EventHub/namespaces/eventhubs/messages/receive/action
conditions:
- service_state
state_logic: "ACTIVE when the principal holds the effective receive permission AND the namespace is\
\ not suspended. BLOCKED if a deny assignment covers the receive action. The escalation consequence\
\ (CanExfiltrate) is produced by the data-plane rules: CanReadData(p, hub) where events carry sensitive\
\ payloads \u2192 CanExfiltrate (cited, not re-derived here). CanReadData alone is data-plane access,\
\ not identity escalation."
confidence: 0.93
derived_from:
- 'effective permission: Azure Event Hubs Data Receiver role / messages/receive/action'
- 'data-plane rules: CanReadData + sensitive payloads => CanExfiltrate (CITED)'
- 'credential-chains.yaml: ContainsSecret(hub, secret) + CanReadData => CanReadSecret (if event body
carries credential material)'
false_positive_note: "Azure Event Hubs Data Receiver grants data-plane receive only; no ARM control\
\ plane. CanReadData on an event hub is high-value only if the event payloads carry sensitive content\
\ (connection strings, tokens, PII) \u2014 this requires content-inspection or naming heuristics (hub\
\ name contains 'auth', 'cred', 'token', 'key'). Without confirmed sensitive payload content, keep\
\ at confidence 0.70 (data access, sensitivity unconfirmed). A Data Receiver cannot send events (no\
\ CanWriteData) and cannot trigger consumers \u2014 the trigger path requires Data Sender or Manage\
\ rights."
narrative: '{principal.name} can receive (consume) events from event hub {target.name} (Azure Event
Hubs Data Receiver / messages/receive/action). If event payloads carry sensitive content (connection
strings, tokens, PII), this yields CanExfiltrate via the data-plane rules.'