rage.fail

azure-la-workflow-http-trigger-contains-callback

explicit azure emits ContainsSecret

match (record)

{ "field": "properties.definition.triggers", "resource_type": "Microsoft.Logic/workflows" }

where

at least one trigger.type == 'Request' (HTTP trigger present) properties.state == 'Enabled'

emit

source type	`Messaging`
target type	`*`
source	`<Logic App workflow>`
target	`<HTTP trigger callback URL (APIKey node, SAS-signed)>`

Narrative

{workflow.name} has an HTTP (Request) trigger with a SAS-signed callback URL stored as an APIKey.

Raw rule rules/explicit/azure-logicapps.yaml

id: azure-la-workflow-http-trigger-contains-callback
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Microsoft.Logic/workflows
  field: properties.definition.triggers
where:
- at least one trigger.type == 'Request' (HTTP trigger present)
- properties.state == 'Enabled'
emit:
  source_type: Messaging
  target_type: '*'
  source: <Logic App workflow>
  target: <HTTP trigger callback URL (APIKey node, SAS-signed)>
  api_source: az rest --method GET --url .../providers/Microsoft.Logic/workflows/<name>
  evidence_field: properties.definition.triggers[*].type == 'Request'
  note: "The actual callback URL is obtained via listCallbackUrl/action (POST) \u2014 the collector should\
    \ NOT call this. The presence of a Request trigger is sufficient evidence to emit ContainsSecret and\
    \ flag the existence of the APIKey node. The listCallbackUrl/action permission on a principal creates\
    \ a CanReadSecret edge (azure-la-callback-url rule)."
  narrative: '{workflow.name} has an HTTP (Request) trigger with a SAS-signed callback URL stored as an
    APIKey.'