azure-la-list-connection-keys

List the embedded key/token for an API connection used by a Logic App (listConnectionKeys/action).

derived azure emits CanReadSecret

match (effective permission)

{ "action": "Microsoft.Web/connections/listConnectionKeys/action", "scope_type": "resource|resourceGroup|subscription" }

emit

source typeIdentity
target type*
source<principal>
target<API connection credential (ConnectionString/Credential/APIKey node)>
permissionsMicrosoft.Web/connections/listConnectionKeys/action
state logicACTIVE when the effective permission is confirmed and the connection has stored credential material (OAuth token, static key, or password). CONDITIONAL when the stored credential is an OAuth token that may have expired (auto-refresh only happens when the Logic App actually runs a connector action). BLOCKED if a deny assignment covers the action.

Narrative

{principal.name} can list the embedded credential of API connection {target.name} (Microsoft.Web/connections/listConnectionKeys/action), extracting the stored Service Bus key, storage account key, SQL password, or OAuth refresh token used by the Logic App's connector actions.

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-list-connection-keys
emits: CanReadSecret
description: List the embedded key/token for an API connection used by a Logic App (listConnectionKeys/action).
match_effective_permission:
  action: Microsoft.Web/connections/listConnectionKeys/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <API connection credential (ConnectionString/Credential/APIKey node)>
  permissions:
  - Microsoft.Web/connections/listConnectionKeys/action
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed and the connection has stored credential
    material (OAuth token, static key, or password). CONDITIONAL when the stored credential is an OAuth
    token that may have expired (auto-refresh only happens when the Logic App actually runs a connector
    action). BLOCKED if a deny assignment covers the action.
  confidence: 0.93
  derived_from:
  - 'effective permission: Microsoft.Web/connections/listConnectionKeys/action'
  false_positive_note: 'The returned material depends on the connector type: Service Bus connections embed
    the primary SAS key (long-lived); storage connections embed an account key (long-lived); SQL connections
    embed the password; OAuth-authenticated connections (Office 365, SharePoint, etc.) embed a refresh
    token that expires if the connection has not been used. Downgrade confidence to 0.7 for OAuth-backed
    connections (token may be expired). The key is stored in the Microsoft.Web/connections resource regardless
    of whether the Logic App is Consumption or Standard tier. credential-chains read-secret-yields-identity
    rolls up CanReadSecret + CredentialsFor -> CanImpersonate; do not re-derive.'
  narrative: '{principal.name} can list the embedded credential of API connection {target.name} (Microsoft.Web/connections/listConnectionKeys/action),
    extracting the stored Service Bus key, storage account key, SQL password, or OAuth refresh token used
    by the Logic App''s connector actions.'
move · open · esc close