azure-eh-namespace-contributor
Full control of an Event Hubs namespace (Contributor / Owner / custom role with namespaces/write); subsumes send, receive, listkeys, and entity management.
match (effective permission)
{
"action": "Microsoft.EventHub/namespaces/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role granting Microsoft.EventHub/namespaces/* at the namespace scope
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Event Hubs namespace (GenericMessaging)> |
| permissions | Microsoft.EventHub/namespaces/write |
| state logic | ACTIVE when the effective permission is confirmed at the namespace or enclosing scope (resource group or subscription). BLOCKED if a deny assignment covers namespaces/write at that scope. CanAdminister on the namespace does NOT imply Microsoft.Authorization/*/write (escalation is via the namespace's managed identity or SAS key reads, not self role-assignment). |
Narrative
{principal.name} has full control of Event Hubs namespace {target.name} (Microsoft.EventHub/namespaces/write), including all event hubs, authorization rules, consumer groups, network rules, and the managed-identity block.
Raw rule rules/derived/azure/eventhubs.yaml
id: azure-eh-namespace-contributor
emits: CanAdminister
description: Full control of an Event Hubs namespace (Contributor / Owner / custom role with namespaces/write);
subsumes send, receive, listkeys, and entity management.
match_effective_permission:
action: Microsoft.EventHub/namespaces/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role granting Microsoft.EventHub/namespaces/*
at the namespace scope
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Event Hubs namespace (GenericMessaging)>
permissions:
- Microsoft.EventHub/namespaces/write
conditions: []
state_logic: ACTIVE when the effective permission is confirmed at the namespace or enclosing scope (resource
group or subscription). BLOCKED if a deny assignment covers namespaces/write at that scope. CanAdminister
on the namespace does NOT imply Microsoft.Authorization/*/write (escalation is via the namespace's
managed identity or SAS key reads, not self role-assignment).
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.EventHub/namespaces/write'
false_positive_note: "Microsoft.EventHub/namespaces/* grants full control of the namespace object and\
\ all child entities (event hubs, authorization rules, consumer groups, network rules) but NOT Microsoft.Authorization/*/write.\
\ The escalation path is via (a) reading SAS keys (listkeys/action) to forge SAS tokens, or (b) redirecting\
\ Capture to attacker storage, or (c) triggering a bound consumer function via send \u2014 NOT via\
\ self-assigning RBAC roles. Confirm the effective permission includes namespaces/write (not merely\
\ namespaces/read) before emitting CanAdminister."
narrative: '{principal.name} has full control of Event Hubs namespace {target.name} (Microsoft.EventHub/namespaces/write),
including all event hubs, authorization rules, consumer groups, network rules, and the managed-identity
block.'