azure-eh-listkeys-namespace

id: azure-eh-listkeys-namespace
emits: CanReadSecret
description: Read SAS signing keys for a namespace-level authorization rule via listkeys/action; the primary
  and secondary keys can forge SAS tokens for all event hubs in the namespace.
match_effective_permission:
  action: Microsoft.EventHub/namespaces/authorizationRules/listkeys/action
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds namespaces/authorizationRules/listkeys/action at the namespace or enclosing
  scope
- the namespace has disableLocalAuth != true (SAS authentication must be enabled)
emit:
  source_type: Identity
  target_type: APIKey
  source: <principal>
  target: "<namespace authorization rule (APIKey node) \u2014 primary + secondary SAS signing keys>"
  permissions:
  - Microsoft.EventHub/namespaces/authorizationRules/listkeys/action
  conditions: []
  state_logic: "ACTIVE when the principal holds listkeys/action at the namespace scope AND disableLocalAuth=false\
    \ (SAS is enabled). BLOCKED when disableLocalAuth=true \u2014 the keys still exist and listkeys returns\
    \ them, but SAS-generated tokens are rejected by the service, so the credential is unusable. BLOCKED\
    \ if a deny assignment covers listkeys/action. CONDITIONAL(key_permission) is not applicable here\
    \ (no wrapping key); the gate is disableLocalAuth."
  confidence: 0.97
  derived_from:
  - 'effective permission: Microsoft.EventHub/namespaces/authorizationRules/listkeys/action'
  - "credential-chains.yaml: read-secret-yields-identity (CanReadSecret + CredentialsFor(SAS key \u2192\
    \ consumer identity) => CanImpersonate)"
  false_positive_note: "namespaces/authorizationRules/read (without /listkeys/action) returns rule names\
    \ and rights but NOT the key values \u2014 do NOT emit CanReadSecret for a read without the listkeys\
    \ action. When disableLocalAuth=true, the keys are returned by the ARM API but cannot authenticate\
    \ to the Event Hubs data plane; emit as BLOCKED. The RootManageSharedAccessKey is always present by\
    \ default unless explicitly deleted; its keys grant Manage + Send + Listen on all event hubs in the\
    \ namespace \u2014 confirm the rule's rights before asserting scope. Honor the ARM scope: listkeys/action\
    \ at RG scope covers all namespaces in the RG."
  narrative: '{principal.name} can read the SAS signing keys for authorization rule {target.name} in Event
    Hubs namespace {namespace.name} (namespaces/authorizationRules/listkeys/action); the primary and secondary
    keys can forge SAS tokens granting Send, Listen, or Manage access to every event hub in the namespace.
    credential-chains read-secret-yields-identity rolls this to CanImpersonate/CanExecuteAs for any SAS-authenticated
    consumer whose identity the SAS token can be presented as.'