azure-evg-namespace-ca-cert
match (record)
{
"field": "properties.encodedCertificate",
"resource_type": "Microsoft.EventGrid/namespaces/caCertificates"
}
where
properties.encodedCertificate is non-empty (CA certificate is loaded)
emit
| source type | GenericMessaging |
|---|---|
| target type | * |
| source | <Event Grid namespace (GenericMessaging / Messaging) |
| target | <CA certificate (Certificate node) trusted for MQTT client auth> |
Narrative
Event Grid namespace {source.name} trusts CA certificate {target.name} for MQTT client authentication; clients presenting a cert signed by this CA can publish to authorized topic spaces.
Raw rule rules/explicit/azure-eventgrid.yaml
id: azure-evg-namespace-ca-cert
emits: ContainsSecret
applies_to:
- azure
match_record:
resource_type: Microsoft.EventGrid/namespaces/caCertificates
field: properties.encodedCertificate
where:
- properties.encodedCertificate is non-empty (CA certificate is loaded)
emit:
source_type: GenericMessaging
target_type: '*'
source: <Event Grid namespace (GenericMessaging / Messaging)
target: <CA certificate (Certificate node) trusted for MQTT client auth>
api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/namespaces/{namespace}/caCertificates
evidence_field: properties.encodedCertificate (PEM-encoded CA cert; thumbprint, not value)
note: An Event Grid namespace that trusts an external CA certificate allows any MQTT client presenting
a certificate signed by that CA to connect and publish/subscribe to topic spaces they are permitted
on (via permission bindings). If the CA is external and attacker-controlled, this is a cross-boundary
trust allowing MQTT publish from the external domain. Record the issuer/thumbprint as the Certificate
node identifier. Source is GenericMessaging (a Messaging subtype), which is in ContainsSecret.source
set.
narrative: Event Grid namespace {source.name} trusts CA certificate {target.name} for MQTT client authentication;
clients presenting a cert signed by this CA can publish to authorized topic spaces.