rage.fail

azure-evg-topic-local-auth-policy

explicit azure emits HasPolicy

match (record)

{ "field": "properties.disableLocalAuth", "resource_type": "Microsoft.EventGrid/topics" }

where

properties.disableLocalAuth == true

emit

source type	`*`
target type	`Policy`
source	`<Event Grid topic>`
target	`<local auth disabled policy (GenericPolicy node)>`

Narrative

Event Grid topic {source.name} has disableLocalAuth=true; SAS key / access-key-based event publishing is disabled; only Entra token publish (events/send/action) is accepted.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-topic-local-auth-policy
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/topics
  field: properties.disableLocalAuth
where:
- properties.disableLocalAuth == true
emit:
  source_type: '*'
  target_type: Policy
  source: <Event Grid topic>
  target: <local auth disabled policy (GenericPolicy node)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/topics/{topic}
  evidence_field: properties.disableLocalAuth
  note: disableLocalAuth=true means key-based publish (aeg-sas-key) is rejected; only Entra token-based
    publish (events/send/action) is accepted. Feeds azure-evg-topic-public BLOCKED gate and azure-evg-publish-via-key
    BLOCKED gate when true.
  narrative: Event Grid topic {source.name} has disableLocalAuth=true; SAS key / access-key-based event
    publishing is disabled; only Entra token publish (events/send/action) is accepted.