azure-evg-key-exposes-credential

An Event Grid topic exposes its access key to any principal who can call listKeys/action; the key is a long-lived publish credential for the topic.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Messaging`
target type	`Credential`
source	`?topic`
target	`<topic access key (AccessKey) — key1 and key2>`
state logic	ACTIVE when the topic exists and has keys (always true for custom topics and domains; keys cannot be disabled without disabling key-based auth entirely). Not applicable to system topics (system topics do not expose user-facing access keys for event publishing).

source type

Messaging

target type

Credential

source

?topic

target

<topic access key (AccessKey) — key1 and key2>

state logic

ACTIVE when the topic exists and has keys (always true for custom topics and domains; keys cannot be disabled without disabling key-based auth entirely). Not applicable to system topics (system topics do not expose user-facing access keys for event publishing).

Narrative

Event Grid topic {source.name} holds access keys (key1, key2) that any principal with listKeys/action can retrieve; the retrieved key is a durable publish credential for the topic, usable for triggering all bound event subscription consumers.

Raw rule rules/derived/azure/eventgrid.yaml

id: azure-evg-key-exposes-credential
emits: ExposesCredential
description: An Event Grid topic exposes its access key to any principal who can call listKeys/action;
  the key is a long-lived publish credential for the topic.
match:
- - topic: null
  - HasPolicy
  - accesspolicy: null
where:
- node_type(?topic) == EventBus
- node_type(?accesspolicy) in [ResourcePolicy, GenericPolicy]
- ?topic has access keys (key1 and key2) that are enabled and non-empty
emit:
  source_type: Messaging
  target_type: Credential
  source: ?topic
  target: "<topic access key (AccessKey) \u2014 key1 and key2>"
  permissions: []
  conditions: []
  state_logic: ACTIVE when the topic exists and has keys (always true for custom topics and domains; keys
    cannot be disabled without disabling key-based auth entirely). Not applicable to system topics (system
    topics do not expose user-facing access keys for event publishing).
  confidence: 1.0
  derived_from:
  - Event Grid topic always has two access keys (key1, key2) for publishing
  - 'azure-evg-list-keys: CanReadSecret to retrieve the key'
  - 'credential-chains.yaml: ExposesCredential feeds downstream publish-as-key CanWriteData'
  false_positive_note: This edge expresses the structural fact that the topic has access keys, not that
    they have been retrieved. The attack step requires a principal to hold listKeys/action (azure-evg-list-keys
    CanReadSecret) AND then use the key for publishing (azure-evg-publish-via-key CanWriteData). Do not
    model this as an escalation edge on its own. System topics do not expose user-publishable access keys;
    do not emit for Microsoft.EventGrid/systemTopics nodes.
  narrative: Event Grid topic {source.name} holds access keys (key1, key2) that any principal with listKeys/action
    can retrieve; the retrieved key is a durable publish credential for the topic, usable for triggering
    all bound event subscription consumers.