rage.fail

azure-evg-domain-key-exposes-credential

explicit azure emits ExposesCredential

match (record)

{ "field": "properties.endpoint", "resource_type": "Microsoft.EventGrid/domains" }

where

properties.endpoint is non-empty

emit

source type	`Messaging`
target type	`Credential`
source	`<Event Grid domain (EventBus/Messaging)>`
target	`<domain access key (AccessKey) — key1 and key2; existence modeled, value not collected>`

Narrative

Event Grid domain {source.name} has access keys (key1, key2) retrievable via domains/listKeys/action; the domain key grants publish access to ALL topics in the domain, triggering all subscribers.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-domain-key-exposes-credential
emits: ExposesCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/domains
  field: properties.endpoint
where:
- properties.endpoint is non-empty
emit:
  source_type: Messaging
  target_type: Credential
  source: <Event Grid domain (EventBus/Messaging)>
  target: "<domain access key (AccessKey) \u2014 key1 and key2; existence modeled, value not collected>"
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/domains/{domain}
  evidence_field: properties.endpoint
  note: 'Domain keys have broader blast radius than topic keys: a domain key authenticates publish to
    ALL topics within the domain. The target AccessKey node should carry a scope annotation indicating
    it grants domain-wide publish. Do NOT collect the actual key values (domains/listKeys/action).'
  narrative: Event Grid domain {source.name} has access keys (key1, key2) retrievable via domains/listKeys/action;
    the domain key grants publish access to ALL topics in the domain, triggering all subscribers.