rage.fail

azure-kv-selfgrant-rbac

Owner/User Access Admin self-assigns a Key Vault data-plane role (RBAC model).

derived azure emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'vault': None}

where

node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults ?vault.properties.enableRbacAuthorization == true (RBAC model) ?principal has EFFECTIVE Microsoft.Authorization/roleAssignments/write at the vault (Owner / User Access Administrator)

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?principal`
permissions	`Microsoft.Authorization/roleAssignments/write`
conditions	`service_state`
state logic	if a deny assignment covers roleAssignments/write: BLOCKED; else ACTIVE

Narrative

{principal.name} can assign itself Key Vault Administrator on {vault.name} (roleAssignments/write) and read all secrets/keys/certs.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-selfgrant-rbac
emits: CanGrantPermission
description: Owner/User Access Admin self-assigns a Key Vault data-plane role (RBAC model).
match:
- - principal: null
  - HasPermission
  - vault: null
where:
- node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
- ?vault.properties.enableRbacAuthorization == true (RBAC model)
- ?principal has EFFECTIVE Microsoft.Authorization/roleAssignments/write at the vault (Owner / User Access
  Administrator)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?principal
  permissions:
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - service_state
  state_logic: 'if a deny assignment covers roleAssignments/write: BLOCKED; else ACTIVE'
  confidence: '0.95'
  derived_from:
  - <HasPermission edge_id (roleAssignments/write)>
  false_positive_note: "Contributor is NOT sufficient here \u2014 roleAssignments/write is only in Owner\
    \ and User Access Administrator (or a custom role explicitly granting it)."
  narrative: '{principal.name} can assign itself Key Vault Administrator on {vault.name} (roleAssignments/write)
    and read all secrets/keys/certs.'