azure-eh-listkeys-entity

id: azure-eh-listkeys-entity
emits: CanReadSecret
description: Read SAS signing keys for an entity-level (event-hub) authorization rule via listkeys/action;
  keys are scoped to one event hub.
match_effective_permission:
  action: Microsoft.EventHub/namespaces/eventhubs/authorizationRules/listkeys/action
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds eventhubs/authorizationRules/listkeys/action at the event-hub or enclosing
  scope
- the namespace has disableLocalAuth != true
emit:
  source_type: Identity
  target_type: APIKey
  source: <principal>
  target: "<event-hub authorization rule (APIKey node) \u2014 primary + secondary SAS signing keys>"
  permissions:
  - Microsoft.EventHub/namespaces/eventhubs/authorizationRules/listkeys/action
  conditions: []
  state_logic: 'ACTIVE when the principal holds the listkeys action AND disableLocalAuth=false. BLOCKED
    when disableLocalAuth=true. BLOCKED if a deny assignment covers eventhubs/authorizationRules/listkeys/action.
    Scope is narrower than azure-eh-listkeys-namespace: keys here apply only to the targeted event hub,
    not the entire namespace.'
  confidence: 0.96
  derived_from:
  - 'effective permission: Microsoft.EventHub/namespaces/eventhubs/authorizationRules/listkeys/action'
  - 'credential-chains.yaml: read-secret-yields-identity'
  false_positive_note: "Entity-level SAS keys scope to a single event hub (Send, Listen, or Manage on\
    \ that entity only). Manage right at the entity level lets the holder manage consumer groups and authorization\
    \ rules for that hub but NOT other hubs. Honor the rule's rights (Send / Listen / Manage) when assessing\
    \ downstream capability (send = CanWriteData, listen = CanReadData, manage = CanAdminister on the\
    \ entity). When disableLocalAuth=true on the namespace, these keys are not usable despite being returned\
    \ by ARM \u2014 emit as BLOCKED."
  narrative: '{principal.name} can read the SAS signing keys for entity authorization rule {target.name}
    on event hub {eventhub.name} (eventhubs/authorizationRules/listkeys/action); the keys can forge SAS
    tokens scoped to Send, Listen, or Manage on that event hub only.'