azure-evg-domain-list-keys

id: azure-evg-domain-list-keys
emits: CanReadSecret
description: Retrieve the domain access key from an Event Grid domain; the key enables publishing to ALL
  topics within the domain, triggering all their subscribers.
match_effective_permission:
  action: Microsoft.EventGrid/domains/listKeys/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: AccessKey
  source: <principal>
  target: <domain access key (AccessKey) for the Event Grid domain>
  permissions:
  - Microsoft.EventGrid/domains/listKeys/action
  conditions: []
  state_logic: 'ACTIVE when the effective permission is confirmed. Higher blast radius than a per-topic
    key: a single domain key grants publish access to ALL topics under the domain. BLOCKED if a deny assignment
    covers domains/listKeys/action.'
  confidence: 0.97
  derived_from:
  - 'effective permission: Microsoft.EventGrid/domains/listKeys/action'
  - 'messaging-chains.yaml: CanWriteData (via domain key publish) + CanTrigger(domain topic->consumer)
    => CanTrigger(principal->consumer)'
  false_positive_note: "The domain key provides publish rights to all topics in the domain \u2014 more\
    \ powerful than a per-topic key. Confirm the scope: listKeys/action at domain resource level returns\
    \ domain-level keys; a principal with only topic-level listKeys cannot use it to derive domain-level\
    \ keys. Scope the ExposesCredential and downstream CanWriteData edges to the entire domain's topic\
    \ set, not just a single topic."
  narrative: '{principal.name} can retrieve the access key for Event Grid domain {target.name} (domains/listKeys/action);
    the domain key permits publishing events to ALL topics in the domain, triggering every subscriber
    bound to any domain topic.'