azure-la-std-appsettings
Read decrypted app settings and connection strings of a Standard Logic App (config/list/Action).
match (effective permission)
{
"action": "Microsoft.Web/sites/config/list/Action",
"scope_type": "resource|resourceGroup|subscription"
}
where
target site has kind containing 'workflowapp' (Standard Logic App)
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <app settings + connection strings of the Standard Logic App> |
| permissions | Microsoft.Web/sites/config/list/Action |
| state logic | ACTIVE when effective permission is confirmed and the app settings carry credential material (storage keys, SQL/Service Bus connection strings, API keys, or publishing credentials). BLOCKED if a deny assignment covers the action. |
Narrative
{principal.name} can read decrypted app settings and connection strings of Standard Logic App {target.name} (Microsoft.Web/sites/config/list/Action), exposing embedded connection strings, storage keys, or API credentials.
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-std-appsettings
emits: CanReadSecret
description: Read decrypted app settings and connection strings of a Standard Logic App (config/list/Action).
match_effective_permission:
action: Microsoft.Web/sites/config/list/Action
scope_type: resource|resourceGroup|subscription
where:
- target site has kind containing 'workflowapp' (Standard Logic App)
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <app settings + connection strings of the Standard Logic App>
permissions:
- Microsoft.Web/sites/config/list/Action
conditions: []
state_logic: ACTIVE when effective permission is confirmed and the app settings carry credential material
(storage keys, SQL/Service Bus connection strings, API keys, or publishing credentials). BLOCKED if
a deny assignment covers the action.
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.Web/sites/config/list/Action'
false_positive_note: "Standard Logic Apps only. config/list/Action returns decrypted appsettings + connectionStrings\
\ (List Web App security sensitive settings). Key Vault references (@Microsoft.KeyVault(...)) in settings\
\ are pointers, not inline secrets \u2014 resolve separately. Emit ContainsSecret only for settings\
\ that actually carry credential material. config/list/Action also returns publishing credentials\
\ (SCM/FTP) \u2014 cross-reference with SCM basic auth policy."
narrative: '{principal.name} can read decrypted app settings and connection strings of Standard Logic
App {target.name} (Microsoft.Web/sites/config/list/Action), exposing embedded connection strings,
storage keys, or API credentials.'