azure-la-list-connection-keys
List the embedded key/token for an API connection used by a Logic App (listConnectionKeys/action).
match (effective permission)
{
"action": "Microsoft.Web/connections/listConnectionKeys/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <API connection credential (ConnectionString/Credential/APIKey node)> |
| permissions | Microsoft.Web/connections/listConnectionKeys/action |
| state logic | ACTIVE when the effective permission is confirmed and the connection has stored credential material (OAuth token, static key, or password). CONDITIONAL when the stored credential is an OAuth token that may have expired (auto-refresh only happens when the Logic App actually runs a connector action). BLOCKED if a deny assignment covers the action. |
Narrative
{principal.name} can list the embedded credential of API connection {target.name} (Microsoft.Web/connections/listConnectionKeys/action), extracting the stored Service Bus key, storage account key, SQL password, or OAuth refresh token used by the Logic App's connector actions.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-list-connection-keys
emits: CanReadSecret
description: List the embedded key/token for an API connection used by a Logic App (listConnectionKeys/action).
match_effective_permission:
action: Microsoft.Web/connections/listConnectionKeys/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <API connection credential (ConnectionString/Credential/APIKey node)>
permissions:
- Microsoft.Web/connections/listConnectionKeys/action
conditions: []
state_logic: ACTIVE when the effective permission is confirmed and the connection has stored credential
material (OAuth token, static key, or password). CONDITIONAL when the stored credential is an OAuth
token that may have expired (auto-refresh only happens when the Logic App actually runs a connector
action). BLOCKED if a deny assignment covers the action.
confidence: 0.93
derived_from:
- 'effective permission: Microsoft.Web/connections/listConnectionKeys/action'
false_positive_note: 'The returned material depends on the connector type: Service Bus connections embed
the primary SAS key (long-lived); storage connections embed an account key (long-lived); SQL connections
embed the password; OAuth-authenticated connections (Office 365, SharePoint, etc.) embed a refresh
token that expires if the connection has not been used. Downgrade confidence to 0.7 for OAuth-backed
connections (token may be expired). The key is stored in the Microsoft.Web/connections resource regardless
of whether the Logic App is Consumption or Standard tier. credential-chains read-secret-yields-identity
rolls up CanReadSecret + CredentialsFor -> CanImpersonate; do not re-derive.'
narrative: '{principal.name} can list the embedded credential of API connection {target.name} (Microsoft.Web/connections/listConnectionKeys/action),
extracting the stored Service Bus key, storage account key, SQL password, or OAuth refresh token used
by the Logic App''s connector actions.'