azure-kv-administer-derives-dataplane
Key Vault Administrator over the vault yields read/decrypt/sign on every object in it.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
the
CanAdminister was produced by azure-kv-administer-dataplane on ?vault (data-plane vaults/*)
node_class(?object) in [Secret, Certificate] # CanReadSecret target set includes Secret and Certificate; keys are handled by the sibling CanDecrypt/CanSignAs derivations below
emit
| source | ?principal |
|---|---|
| target | ?object |
| permissions | Microsoft.KeyVault/vaults/secrets/getSecret/action |
| conditions | network_reachability |
| state logic | inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED) |
Narrative
{principal.name}, as Key Vault Administrator on {vault.name}, can read secret/certificate {object.name}.
Raw rule rules/derived/azure/keyvault.yaml
id: azure-kv-administer-derives-dataplane
emits: CanReadSecret
description: Key Vault Administrator over the vault yields read/decrypt/sign on every object in it.
match:
- - principal: null
- CanAdminister
- vault: null
- - vault: null
- Contains
- object: null
where:
- the CanAdminister was produced by azure-kv-administer-dataplane on ?vault (data-plane vaults/*)
- 'node_class(?object) in [Secret, Certificate] # CanReadSecret target set includes Secret and Certificate;
keys are handled by the sibling CanDecrypt/CanSignAs derivations below'
emit:
source: ?principal
target: ?object
permissions:
- Microsoft.KeyVault/vaults/secrets/getSecret/action
conditions:
- network_reachability
state_logic: inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED)
confidence: min(contributing_confidences) * 0.98
derived_from:
- <azure-kv-administer-dataplane CanAdminister edge_id>
- <Contains edge_id>
false_positive_note: Only fans out from the DATA-plane CanAdminister (Key Vault Administrator), never
from the control-plane one. Vault-wide (Administrator carries vaults/*), unlike an object-scoped grant.
Sibling derivations azure-kv-administer-derives-decrypt / -derives-sign cover keys.
narrative: '{principal.name}, as Key Vault Administrator on {vault.name}, can read secret/certificate
{object.name}.'