rage.fail

azure-kv-external-grant

explicit azure emits TrustsExternalIdentity

match (record)

{ "field": "properties.accessPolicies[].objectId", "resource_type": "Microsoft.KeyVault/vaults" }

where

accessPolicies[].tenantId != vault home tenant OR grantee is a B2B guest / multi-tenant app SP

emit

source	`<vault accessPolicies ResourcePolicy node>`
target	`<external principal>`

Narrative

{vault.name} access policy grants data-plane access to external principal {external.name}.

Raw rule rules/explicit/azure-keyvault.yaml

id: azure-kv-external-grant
emits: TrustsExternalIdentity
applies_to:
- azure
match_record:
  resource_type: Microsoft.KeyVault/vaults
  field: properties.accessPolicies[].objectId
where:
- accessPolicies[].tenantId != vault home tenant OR grantee is a B2B guest / multi-tenant app SP
emit:
  source: <vault accessPolicies ResourcePolicy node>
  target: <external principal>
  api_source: Microsoft.KeyVault/vaults GET
  evidence_field: properties.accessPolicies[].objectId
  note: TrustsExternalIdentity source set is [Role, ServiceAccount, ApplicationIdentity, ResourcePolicy];
    source the vault's accessPolicies ResourcePolicy node (not the vault ManagementService node) to stay
    within the edge's declared source set.
  narrative: '{vault.name} access policy grants data-plane access to external principal {external.name}.'