azure-la-connection-contains-credential
match (record)
{
"field": "properties.statuses",
"resource_type": "Microsoft.Web/connections"
}
where
properties.statuses[*].status contains 'Connected'
properties.api.name is present (connector type known)
emit
| source type | Messaging |
|---|---|
| target type | * |
| source | <API connection (modeled as Messaging/ConnectionString node)> |
| target | <embedded service credential for the backend resource (Secret/Credential node)> |
Narrative
API connection {connection.name} ({connector.name}) stores a credential (SAS key / storage key / SQL password / OAuth token) for its backend service.
Raw rule rules/explicit/azure-logicapps.yaml
id: azure-la-connection-contains-credential
emits: ContainsSecret
applies_to:
- azure
match_record:
resource_type: Microsoft.Web/connections
field: properties.statuses
where:
- properties.statuses[*].status contains 'Connected'
- properties.api.name is present (connector type known)
emit:
source_type: Messaging
target_type: '*'
source: <API connection (modeled as Messaging/ConnectionString node)>
target: <embedded service credential for the backend resource (Secret/Credential node)>
api_source: az rest --method GET --url .../providers/Microsoft.Web/connections
evidence_field: properties.api.name + properties.statuses[].status
note: 'The credential type depends on the connector: serviceBus -> SAS key; azureblob / azuretables
-> storage account key; sql -> SQL password; office365 / sharepointonline -> OAuth refresh token.
Tag the target Secret node''s type accordingly. oauth-backed connections (status=Connected but token
may expire) should note expiry risk. ContainsSecret (source: Messaging) is used rather than ContainsCredential
because ContainsCredential.source only allows [Storage, Data, Compute]; ContainsSecret allows Messaging.'
narrative: API connection {connection.name} ({connector.name}) stores a credential (SAS key / storage
key / SQL password / OAuth token) for its backend service.