azure-la-run-history-read-secret

id: azure-la-run-history-read-secret
emits: CanReadSecret
description: Read run-history expression traces containing secrets (API keys, connection strings, tokens)
  via listExpressionTraces/action.
match_effective_permission:
  action: Microsoft.Logic/workflows/runs/actions/listExpressionTraces/action
  scope_type: resource|resourceGroup|subscription
where:
- ?principal also holds Microsoft.Logic/workflows/runs/read (to list run-history records)
emit:
  source_type: Identity
  target_type: Secret
  source: <principal>
  target: <secrets exposed in workflow run-history expression traces (Secret/Credential node)>
  permissions:
  - Microsoft.Logic/workflows/runs/read
  - Microsoft.Logic/workflows/runs/actions/listExpressionTraces/action
  conditions: []
  state_logic: ACTIVE when the principal holds both runs/read and listExpressionTraces/action on the Logic
    App workflow scope. Run history contains evaluated inputs/outputs of workflow actions; if a workflow
    passes a secret through a variable or HTTP response body, the trace data exposes it. CONDITIONAL if
    run history is archived or purged (retention period).
  confidence: 0.85
  derived_from:
  - '<ContainsSecret edge: <run-history node> -> ?secret> (from explicit rule azure-la-run-history-expression-traces)'
  false_positive_note: "Requires both Microsoft.Logic/workflows/runs/read (to list runs) and listExpressionTraces/action\
    \ (to read trace data). Run history retention is limited (typically 30 days by default) \u2014 older\
    \ secrets expire from the store. Emit only when a run with secret-bearing traces is confirmed extant."
  narrative: '{principal.name} can read Logic App {target.name} run-history expression traces (Microsoft.Logic/workflows/runs/actions/listExpressionTraces/action),
    exposing secrets (API keys, connection strings, OAuth tokens) passed through workflow variables or
    HTTP action outputs.'