azure-kv-administer-controlplane

Owner/Contributor/Key Vault Contributor (control-plane vaults/write) fully controls the vault object.

derived azure emits CanAdminister

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?vault`
permissions	`Microsoft.KeyVault/vaults/write`
conditions	`service_state`
state logic	if a deny assignment/deny Azure Policy covers vaults/write: BLOCKED; else ACTIVE

source type

Identity

target type

*

source

?principal

target

?vault

permissions

Microsoft.KeyVault/vaults/write

conditions

service_state

state logic

if a deny assignment/deny Azure Policy covers vaults/write: BLOCKED; else ACTIVE

Narrative

{principal.name} controls vault {vault.name} at the control plane (Microsoft.KeyVault/vaults/write) - networkAcls, deletion, and the self-grant lever.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-administer-controlplane
emits: CanAdminister
description: Owner/Contributor/Key Vault Contributor (control-plane vaults/write) fully controls the vault
  object.
match:
- - principal: null
  - HasPermission
  - vault: null
where:
- node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
- ?principal has EFFECTIVE Microsoft.KeyVault/vaults/write at vault scope (Owner, Contributor, or Key
  Vault Contributor f25e0fa2-a7c8-4377-a976-54943a77a395)
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?vault
  permissions:
  - Microsoft.KeyVault/vaults/write
  conditions:
  - service_state
  state_logic: 'if a deny assignment/deny Azure Policy covers vaults/write: BLOCKED; else ACTIVE'
  confidence: '0.9'
  derived_from:
  - <HasPermission edge_id (vaults/write)>
  false_positive_note: "Control-plane admin of the vault OBJECT (networkAcls, delete, and \u2014 only\
    \ in the access-policy model \u2014 accessPolicies) is NOT by itself data-plane read. On an RBAC-model\
    \ vault, vaults/write does NOT grant secret read; the data-plane path from here runs through the self-grant\
    \ lever (azure-kv-contributor-selfgrant-accesspolicy needs the access-policy model, or azure-kv-selfgrant-rbac\
    \ needs roleAssignments/write). Do not imply secret read from this edge on an RBAC vault."
  narrative: "{principal.name} controls vault {vault.name} at the control plane (Microsoft.KeyVault/vaults/write)\
    \ \u2014 networkAcls, deletion, and the self-grant lever."