azure-la-connection-exposescred

An API connection stores a long-lived service credential (key/token) usable by any code that can call listConnectionKeys.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Messaging`
target type	`Identity`
source	`<API connection (ConnectionString node)>`
target	`<identity/service the embedded credential authenticates as>`
state logic	ACTIVE when the connection has confirmed stored credential material. CONDITIONAL when the credential is an OAuth refresh token that may be expired (auto-refresh only on connector action run).

source type

Messaging

target type

Identity

source

<API connection (ConnectionString node)>

target

<identity/service the embedded credential authenticates as>

state logic

ACTIVE when the connection has confirmed stored credential material. CONDITIONAL when the credential is an OAuth refresh token that may be expired (auto-refresh only on connector action run).

Narrative

API connection {connection.name} stores a long-lived service credential (Service Bus key / storage key / SQL password) exposed via listConnectionKeys/action to any principal who can call that action.

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-connection-exposescred
emits: ExposesCredential
description: An API connection stores a long-lived service credential (key/token) usable by any code that
  can call listConnectionKeys.
match:
- - connection: null
  - ContainsSecret
  - cred: null
where:
- node_type(?connection) == ConnectionString or node_class(?connection) == Messaging
- ?connection is a Microsoft.Web/connections resource
emit:
  source_type: Messaging
  target_type: Identity
  source: <API connection (ConnectionString node)>
  target: <identity/service the embedded credential authenticates as>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the connection has confirmed stored credential material. CONDITIONAL when the
    credential is an OAuth refresh token that may be expired (auto-refresh only on connector action run).
  confidence: 0.85
  derived_from:
  - '<ContainsSecret edge: ?connection -> ?cred>'
  false_positive_note: An API connection's embedded credential leaks to any code that calls listConnectionKeys/action.
    The target identity/service depends on the connector type (Service Bus namespace, storage account,
    SQL server, etc.). credential-chains rolls up ContainsSecret + CredentialsFor -> the downstream access
    edge; this rule emits only the fact that the connection stores and exposes the credential.
  narrative: API connection {connection.name} stores a long-lived service credential (Service Bus key
    / storage key / SQL password) exposed via listConnectionKeys/action to any principal who can call
    that action.