azure-kv-administer-dataplane
Key Vault Administrator (data-plane vaults/* dataAction) fully controls the vault data plane.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
?principal has EFFECTIVE dataAction Microsoft.KeyVault/vaults/* at vault scope (Key Vault Administrator 00482a5a-887f-4fb3-b363-3b7fe8e74483, or an access-policy entry granting all secrets/keys/certificates permissions)
emit
| source type | Identity |
|---|---|
| target type | * |
| source | ?principal |
| target | ?vault |
| permissions | Microsoft.KeyVault/vaults/* |
| conditions | network_reachability |
| state logic | if networkAcls Deny-default blocks the caller: CONDITIONAL(network_reachability); elif a deny assignment/deny Azure Policy covers the dataActions: BLOCKED; else ACTIVE |
Narrative
{principal.name} is Key Vault Administrator on {vault.name} (Microsoft.KeyVault/vaults/* data plane) and can read/decrypt/sign every secret, key, and certificate in it.
Raw rule rules/derived/azure/keyvault.yaml
id: azure-kv-administer-dataplane
emits: CanAdminister
description: Key Vault Administrator (data-plane vaults/* dataAction) fully controls the vault data plane.
match:
- - principal: null
- HasPermission
- vault: null
where:
- node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
- ?principal has EFFECTIVE dataAction Microsoft.KeyVault/vaults/* at vault scope (Key Vault Administrator
00482a5a-887f-4fb3-b363-3b7fe8e74483, or an access-policy entry granting all secrets/keys/certificates
permissions)
emit:
source_type: Identity
target_type: '*'
source: ?principal
target: ?vault
permissions:
- Microsoft.KeyVault/vaults/*
conditions:
- network_reachability
state_logic: 'if networkAcls Deny-default blocks the caller: CONDITIONAL(network_reachability); elif
a deny assignment/deny Azure Policy covers the dataActions: BLOCKED; else ACTIVE'
confidence: '0.95'
derived_from:
- <HasPermission edge_id (vaults/* dataAction / Key Vault Administrator)>
false_positive_note: "Key Vault Administrator is the DATA-plane superset (secrets get + keys decrypt/unwrap/sign\
\ + certificates) \u2014 it is the single most direct full-data-plane path. Do NOT confuse it with\
\ Key Vault Reader (metadata only). A Deny-default firewall makes it CONDITIONAL(network_reachability)\
\ for outside callers, not ACTIVE."
narrative: '{principal.name} is Key Vault Administrator on {vault.name} (Microsoft.KeyVault/vaults/*
data plane) and can read/decrypt/sign every secret, key, and certificate in it.'