rage.fail

azure-la-run-history-expression-traces

explicit azure emits ContainsSecret

match (record)

{ "field": "properties.actions", "resource_type": "Microsoft.Logic/workflows/runs" }

where

action outputs or inputs contain credential material (storage keys, API keys, connection strings, OAuth tokens) in evaluated expressions or HTTP response bodies

emit

source type	`Messaging`
target type	`*`
source	`<Logic App workflow run history>`
target	`<secret exposed in expression trace (Secret/Credential node)>`

Narrative

{workflow.name} run history contains a secret exposed in action expression trace ({secret.name}).

Raw rule rules/explicit/azure-logicapps.yaml

id: azure-la-run-history-expression-traces
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Microsoft.Logic/workflows/runs
  field: properties.actions
where:
- action outputs or inputs contain credential material (storage keys, API keys, connection strings, OAuth
  tokens) in evaluated expressions or HTTP response bodies
emit:
  source_type: Messaging
  target_type: '*'
  source: <Logic App workflow run history>
  target: <secret exposed in expression trace (Secret/Credential node)>
  api_source: az rest --method GET --url .../providers/Microsoft.Logic/workflows/<name>/runs
  evidence_field: runs[*].properties.actions[*].inputsLink / outputsLink
  note: Run history stores the evaluated inputs/outputs of each action. If a workflow passes a secret
    through a variable or an HTTP action response body, the run history may expose it. Requires Microsoft.Logic/workflows/runs/actions/listExpressionTraces/action
    to read. Emit ContainsSecret only when concrete credential patterns are found in the trace data; do
    not emit speculatively.
  narrative: '{workflow.name} run history contains a secret exposed in action expression trace ({secret.name}).'