azure-evg-event-contains-secret
match (record)
{
"field": "properties.inputSchema",
"resource_type": "Microsoft.EventGrid/topics"
}
where
analyst has confirmed via schema inspection or payload sampling that event data fields include credential material (connection strings, access tokens,
API keys, SAS URIs, passwords)
emit
| source type | Messaging |
|---|---|
| target type | * |
| source | <Event Grid topic or system topic (EventBus/Messaging)> |
| target | <secret embedded in event payload (Secret/Credential node)> |
Narrative
Events published to {source.name} contain credential material ({secret.type}) in the event payload; any principal that can read the event stream (via subscription redirect or queue consumer access) obtains those credentials.
Raw rule rules/explicit/azure-eventgrid.yaml
id: azure-evg-event-contains-secret
emits: ContainsSecret
applies_to:
- azure
match_record:
resource_type: Microsoft.EventGrid/topics
field: properties.inputSchema
where:
- analyst has confirmed via schema inspection or payload sampling that event data fields include credential
material (connection strings, access tokens, API keys, SAS URIs, passwords)
emit:
source_type: Messaging
target_type: '*'
source: <Event Grid topic or system topic (EventBus/Messaging)>
target: <secret embedded in event payload (Secret/Credential node)>
api_source: Topic schema from properties.inputSchema + analyst payload sampling
evidence_field: Event payload schema or sampled event data confirming credential material
note: 'Do NOT emit speculatively. Emit only when concrete evidence shows event payloads carry secret
material. Common sources: Azure Key Vault system topics emit events with secret/key/certificate metadata
(not the secret values); Storage system topics emit blob names and SAS URIs (a SAS URI IS a credential).
Custom topics may embed application-specific tokens. credential-chains read-secret-yields-identity
will fire if a CanReadData path exists to this event source and the secret is a CredentialsFor target.'
narrative: Events published to {source.name} contain credential material ({secret.type}) in the event
payload; any principal that can read the event stream (via subscription redirect or queue consumer
access) obtains those credentials.