rage.fail

azure-kv-access-policy-secret-get

explicit azure emits HasPermission

match (record)

{ "field": "properties.accessPolicies[].permissions.secrets", "resource_type": "Microsoft.KeyVault/vaults" }

where

properties.enableRbacAuthorization == false entry permissions.secrets contains 'get'

emit

source type	`Identity`
target type	`*`
source	`<principal for accessPolicies[].objectId>`
target	`<vault or object scope>`
permissions	`Microsoft.KeyVault/vaults/secrets/getSecret/action`

Narrative

{principal.name} has an access-policy grant of secrets:get on {vault.name}.

Raw rule rules/explicit/azure-keyvault.yaml

id: azure-kv-access-policy-secret-get
emits: HasPermission
applies_to:
- azure
match_record:
  resource_type: Microsoft.KeyVault/vaults
  field: properties.accessPolicies[].permissions.secrets
where:
- properties.enableRbacAuthorization == false
- entry permissions.secrets contains 'get'
emit:
  source_type: Identity
  target_type: '*'
  source: <principal for accessPolicies[].objectId>
  target: <vault or object scope>
  api_source: Microsoft.KeyVault/vaults GET
  permissions:
  - Microsoft.KeyVault/vaults/secrets/getSecret/action
  evidence_field: properties.accessPolicies[].permissions.secrets
  narrative: '{principal.name} has an access-policy grant of secrets:get on {vault.name}.'