azure-kv-selfgrant-derives-read
A vault self-grant yields read of every secret/cert in the vault.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanGrantPermission {'principal': None}
{'vault': None} Contains {'object': None}
where
the
CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac on ?vault
node_class(?object) in [Secret, Certificate] # CanReadSecret target set includes Secret and Certificate
emit
| source | ?principal |
|---|---|
| target | ?object |
| permissions | Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write Microsoft.KeyVault/vaults/secrets/getSecret/action |
| conditions | network_reachability |
| state logic | inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks caller: CONDITIONAL(network_reachability) |
Narrative
{principal.name} can self-grant data-plane access to {vault.name} and then read secret/certificate {object.name}.
Raw rule rules/derived/azure/keyvault.yaml
id: azure-kv-selfgrant-derives-read
emits: CanReadSecret
description: A vault self-grant yields read of every secret/cert in the vault.
match:
- - principal: null
- CanGrantPermission
- principal: null
- - vault: null
- Contains
- object: null
where:
- the CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac
on ?vault
- 'node_class(?object) in [Secret, Certificate] # CanReadSecret target set includes Secret and Certificate'
emit:
source: ?principal
target: ?object
permissions:
- Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write
- Microsoft.KeyVault/vaults/secrets/getSecret/action
conditions:
- network_reachability
state_logic: 'inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks
caller: CONDITIONAL(network_reachability)'
confidence: min(contributing_confidences) * 0.9
derived_from:
- <self-grant CanGrantPermission edge_id>
- <Contains edge_id>
false_positive_note: 'Two-step, not one action: the principal must first add the policy/role, then read.
Still ACTIVE because both steps are within its control. Fans out to ALL secrets/certs in the vault
(vault-wide self-grant), unlike an object-scoped data-plane grant. Sibling rules azure-kv-selfgrant-derives-decrypt
/ -derives-sign complete the key fan-out (CanDecrypt / CanSignAs).'
narrative: '{principal.name} can self-grant data-plane access to {vault.name} and then read secret/certificate
{object.name}.'