azure-la-connection-cross-subscription
An API connection referencing a resource in a different subscription (same tenant) represents cross-subscription exposure.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?connection is a Microsoft.Web/connections resource (node_class == Messaging)
the backend resource is in a DIFFERENT subscription than the Logic App
backend_subscription != logic_app_subscription
backend_tenant == logic_app_tenant (same Entra tenant)
emit
| source type | Messaging |
|---|---|
| target type | Subscription |
| source | <API connection resource> |
| target | <subscription containing the backend resource> |
| conditions | resource_policy |
| state logic | ACTIVE when the connection is confirmed to authenticate to a resource in another subscription and the credential has not expired. CONDITIONAL(resource_policy) if the backend subscription has an org policy or deny assignment restricting cross-subscription access. |
Narrative
API connection {connection.name} stores a credential authenticating to a resource in another Azure subscription (same Entra tenant), exposing cross-subscription access for the Logic App's execution identity.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-connection-cross-subscription
emits: ExposedToAccount
description: An API connection referencing a resource in a different subscription (same tenant) represents
cross-subscription exposure.
match:
- - connection: null
- ContainsSecret
- cred: null
where:
- ?connection is a Microsoft.Web/connections resource (node_class == Messaging)
- the backend resource is in a DIFFERENT subscription than the Logic App
- backend_subscription != logic_app_subscription
- backend_tenant == logic_app_tenant (same Entra tenant)
emit:
source_type: Messaging
target_type: Subscription
source: <API connection resource>
target: <subscription containing the backend resource>
permissions: []
conditions:
- resource_policy
state_logic: ACTIVE when the connection is confirmed to authenticate to a resource in another subscription
and the credential has not expired. CONDITIONAL(resource_policy) if the backend subscription has an
org policy or deny assignment restricting cross-subscription access.
confidence: 0.8
derived_from:
- '<ContainsSecret edge: ?connection -> ?cred>'
false_positive_note: Cross-subscription same-tenant connections are common and often intentional. This
edge models the exposure of the credential across a subscription boundary, not a threat in isolation.
Pair with CanReadSecret to assess risk. can-control may derive CanEnterSubscription if the principal
reads the credential and uses it to access the remote subscription.
narrative: API connection {connection.name} stores a credential authenticating to a resource in another
Azure subscription (same Entra tenant), exposing cross-subscription access for the Logic App's execution
identity.