azure-evg-topic-key-exposes-credential
match (record)
{
"field": "properties.endpoint",
"resource_type": "Microsoft.EventGrid/topics"
}
where
properties.endpoint is non-empty
properties.kind != SystemTopic
topic is of type Microsoft.EventGrid/topics (custom topic, not systemTopics resource)
emit
| source type | Messaging |
|---|---|
| target type | Credential |
| source | <Event Grid custom topic (EventBus/Messaging)> |
| target | <topic access key (AccessKey) — key1 and key2; existence modeled, value not collected> |
Narrative
Event Grid topic {source.name} has access keys (key1, key2) retrievable via topics/listKeys/action; any holder of those keys can publish arbitrary events to the topic.
Raw rule rules/explicit/azure-eventgrid.yaml
id: azure-evg-topic-key-exposes-credential
emits: ExposesCredential
applies_to:
- azure
match_record:
resource_type: Microsoft.EventGrid/topics
field: properties.endpoint
where:
- properties.endpoint is non-empty
- properties.kind != SystemTopic
- topic is of type Microsoft.EventGrid/topics (custom topic, not systemTopics resource)
emit:
source_type: Messaging
target_type: Credential
source: <Event Grid custom topic (EventBus/Messaging)>
target: "<topic access key (AccessKey) \u2014 key1 and key2; existence modeled, value not collected>"
api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/topics/{topic}
evidence_field: properties.endpoint (presence confirms topic is active and keys exist)
note: "The key VALUES are not collected \u2014 calling topics/listKeys/action in a read-only collector\
\ would retrieve active secrets. This edge records that the key MATERIAL exists on the topic. The\
\ CanReadSecret edge (azure-evg-list-keys in derived rules) represents the permission to retrieve\
\ it. Source is Messaging (EventBus is a subtype). Do NOT emit for Microsoft.EventGrid/systemTopics\
\ resources \u2014 system topics do not expose user-publishable access keys."
narrative: Event Grid topic {source.name} has access keys (key1, key2) retrievable via topics/listKeys/action;
any holder of those keys can publish arbitrary events to the topic.