azure-evg-list-keys
Retrieve the topic access key (aeg-sas-key) from an Event Grid custom topic; the key enables unlimited event publishing to the topic, triggering all subscribers.
match (effective permission)
{
"action": "Microsoft.EventGrid/topics/listKeys/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | AccessKey |
| source | <principal> |
| target | <topic access key (AccessKey) for the Event Grid topic> |
| permissions | Microsoft.EventGrid/topics/listKeys/action |
| state logic | ACTIVE when the effective permission is confirmed. The key is a long-lived shared secret retrievable on demand; it does not expire unless manually regenerated. BLOCKED if a deny assignment covers listKeys/action at the effective scope. A topic with publicNetworkAccess=Disabled does NOT neutralize the key itself — the key can still be used from within the VNet or from a private endpoint. Key retrieval does not require physical network access to the topic endpoint. |
Narrative
{principal.name} can retrieve the access key for Event Grid topic {target.name} (topics/listKeys/action); the key permits publishing arbitrary events to the topic via HTTPS (aeg-sas-key header) without Entra authentication, triggering all bound event subscriptions.
Raw rule rules/derived/azure/eventgrid.yaml
id: azure-evg-list-keys
emits: CanReadSecret
description: Retrieve the topic access key (aeg-sas-key) from an Event Grid custom topic; the key enables
unlimited event publishing to the topic, triggering all subscribers.
match_effective_permission:
action: Microsoft.EventGrid/topics/listKeys/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: AccessKey
source: <principal>
target: <topic access key (AccessKey) for the Event Grid topic>
permissions:
- Microsoft.EventGrid/topics/listKeys/action
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed. The key is a long-lived shared secret\
\ retrievable on demand; it does not expire unless manually regenerated. BLOCKED if a deny assignment\
\ covers listKeys/action at the effective scope. A topic with publicNetworkAccess=Disabled does NOT\
\ neutralize the key itself \u2014 the key can still be used from within the VNet or from a private\
\ endpoint. Key retrieval does not require physical network access to the topic endpoint."
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.EventGrid/topics/listKeys/action'
- 'credential-chains.yaml: CanReadSecret + CredentialsFor(key -> publish right) feeds ExposesCredential'
false_positive_note: "The key permits publishing to the topic, not subscribing or reading events from\
\ consumer endpoints. Two keys exist (key1, key2) for rotation; both are returned by listKeys. This\
\ edge is ACTIVE on confirmation of listKeys/action in effective permissions \u2014 no additional\
\ state gate needed, since retrieving a key is an instantaneous ARM API call with no further prerequisite.\
\ Do not confuse with Microsoft.EventGrid/topics/regenerateKey/action (which rotates/destroys the\
\ key). A topic key for a domain topic is distinct from the domain-level key (see azure-evg-domain-list-keys);\
\ scope accordingly."
narrative: '{principal.name} can retrieve the access key for Event Grid topic {target.name} (topics/listKeys/action);
the key permits publishing arbitrary events to the topic via HTTPS (aeg-sas-key header) without Entra
authentication, triggering all bound event subscriptions.'