rage.fail

azure-kv-exposed-to-tenant

Public-network + Allow-default firewall exposes the data plane tenant-wide (still Entra-authz).

derived azure emits ExposedToTenant

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'vault': None} Contains {'secret': None}

where

node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults ?vault.properties.publicNetworkAccess == 'Enabled' ?vault.properties.networkAcls.defaultAction == 'Allow'

emit

source type	`*`
source	`?vault`
target	`<tenant>`
conditions	`network_reachability`
state logic	ACTIVE for network reachability; data access STILL requires Entra data-plane authz (not anonymous)

Narrative

Vault {vault.name} data plane is reachable from any network (publicNetworkAccess=Enabled, firewall default Allow); access still needs an Entra data-plane grant.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-exposed-to-tenant
emits: ExposedToTenant
description: Public-network + Allow-default firewall exposes the data plane tenant-wide (still Entra-authz).
match:
- - vault: null
  - Contains
  - secret: null
where:
- node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
- ?vault.properties.publicNetworkAccess == 'Enabled'
- ?vault.properties.networkAcls.defaultAction == 'Allow'
emit:
  source_type: '*'
  source: ?vault
  target: <tenant>
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE for network reachability; data access STILL requires Entra data-plane authz (not
    anonymous)
  confidence: '0.8'
  derived_from:
  - <vault networkAcls record>
  false_positive_note: "This is transport-level reachability only \u2014 NOT ExposedToInternet to an AnonymousIdentity.\
    \ Key Vault always requires Entra authentication and a data-plane grant. Do not treat as anonymous\
    \ secret exposure."
  narrative: Vault {vault.name} data plane is reachable from any network (publicNetworkAccess=Enabled,
    firewall default Allow); access still needs an Entra data-plane grant.