rage.fail

azure-kv-access-policy-key-crypto

explicit azure emits HasPermission

match (record)

{ "field": "properties.accessPolicies[].permissions.keys", "resource_type": "Microsoft.KeyVault/vaults" }

where

properties.enableRbacAuthorization == false entry permissions.keys contains any of 'decrypt','unwrapKey','sign'

emit

source type	`Identity`
target type	`*`
source	`<principal for accessPolicies[].objectId>`
target	`<vault or object scope>`
permissions	`Microsoft.KeyVault/vaults/keys/decrypt/action` `Microsoft.KeyVault/vaults/keys/unwrap/action` `Microsoft.KeyVault/vaults/keys/sign/action`

Narrative

{principal.name} has an access-policy grant of key decrypt/unwrapKey/sign on {vault.name}.

Raw rule rules/explicit/azure-keyvault.yaml

id: azure-kv-access-policy-key-crypto
emits: HasPermission
applies_to:
- azure
match_record:
  resource_type: Microsoft.KeyVault/vaults
  field: properties.accessPolicies[].permissions.keys
where:
- properties.enableRbacAuthorization == false
- entry permissions.keys contains any of 'decrypt','unwrapKey','sign'
emit:
  source_type: Identity
  target_type: '*'
  source: <principal for accessPolicies[].objectId>
  target: <vault or object scope>
  api_source: Microsoft.KeyVault/vaults GET
  permissions:
  - Microsoft.KeyVault/vaults/keys/decrypt/action
  - Microsoft.KeyVault/vaults/keys/unwrap/action
  - Microsoft.KeyVault/vaults/keys/sign/action
  evidence_field: properties.accessPolicies[].permissions.keys
  narrative: '{principal.name} has an access-policy grant of key decrypt/unwrapKey/sign on {vault.name}.'