azure-eh-data-sender

id: azure-eh-data-sender
emits: CanWriteData
description: Azure Event Hubs Data Sender role (or equivalent custom role) grants send (publish) access
  to an event hub; feeds messaging-chains trigger primitive.
match_effective_permission:
  action: Microsoft.EventHub/namespaces/eventhubs/messages/send/action
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Azure Event Hubs Data Sender, Azure Event Hubs Data Owner, or a custom role
  granting send permission on the event hub
emit:
  source_type: Identity
  target_type: Queue
  source: <principal>
  target: <event hub (Queue node)>
  permissions:
  - Microsoft.EventHub/namespaces/eventhubs/messages/send/action
  conditions:
  - service_state
  state_logic: "ACTIVE when the principal holds the effective send permission AND the namespace is not\
    \ suspended. BLOCKED if a deny assignment covers the send action. A principal who holds CanWriteData\
    \ on the hub AND a CanTrigger(hub \u2192 consumer) binding exists feeds messaging-chains messaging-publish-triggers-consumer:\
    \ messaging-publish-triggers-consumer produces CanTrigger(principal \u2192 consumer) CONDITIONAL(trigger_exists)\
    \ and messaging-trigger-executes-as then produces CanExecuteAs CONDITIONAL(trigger_exists). Both are\
    \ cited from messaging-chains and NOT re-derived here."
  confidence: 0.96
  derived_from:
  - 'effective permission: Azure Event Hubs Data Sender role / messages/send/action'
  - "messaging-chains.yaml: messaging-publish-triggers-consumer (rule 1) \u2014 CanWriteData + CanTrigger(hub\u2192\
    consumer) => CanTrigger(principal\u2192consumer)"
  - "messaging-chains.yaml: messaging-trigger-executes-as (rule 2) \u2014 CanTrigger(p\u2192consumer)\
    \ + ExecutesAs(consumer, identity) => CanExecuteAs"
  false_positive_note: "Azure Event Hubs Data Sender grants data-plane send only; it does NOT include\
    \ listkeys/action (SAS key reads) or any ARM control-plane write. CanWriteData alone is NOT escalation\
    \ unless a consumer binding (Function trigger, SA input, Logic App connector) routes the hub to an\
    \ executing consumer. Without a confirmed CanTrigger(hub \u2192 consumer) edge, messaging-publish-triggers-consumer\
    \ in messaging-chains does not fire \u2014 keep CanWriteData as a data-plane send capability only.\
    \ Honor scope: if the role is assigned at a consumer-group level (which Azure RBAC supports for Data\
    \ Receiver but NOT for Data Sender \u2014 Sender is at namespace or event-hub level only), adjust\
    \ accordingly."
  narrative: "{principal.name} can send (publish) events to event hub {target.name} (Azure Event Hubs\
    \ Data Sender / messages/send/action). If {target.name} is bound to a consumer (Azure Function event-hub\
    \ trigger, Stream Analytics input, Logic App connector), messaging-chains messaging-publish-triggers-consumer\
    \ derives CanTrigger({principal.name} \u2192 consumer) CONDITIONAL(trigger_exists), and messaging-trigger-executes-as\
    \ then derives CanExecuteAs(consumer's MI)."