azure-nh-hub-listkeys-reads-sas

id: azure-nh-hub-listkeys-reads-sas
emits: CanReadSecret
description: Retrieve the raw SAS key (primaryKey/secondaryKey/connectionStrings) from a Notification
  Hub authorization rule via ARM listKeys; the DefaultFullSharedAccessSignature key yields hub-wide Send+Manage
  data-plane access.
match_effective_permission:
  action: Microsoft.NotificationHubs/namespaces/notificationHubs/authorizationRules/listkeys/action
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds the listkeys/action at the notificationHub scope (hub-level, not namespace-level)
- at least one authorization rule on the hub carries Send or Manage rights
emit:
  source_type: Identity
  target_type: ConnectionString
  source: <principal>
  target: <hub SAS authorization rule ConnectionString (DefaultFullSharedAccessSignature or custom backend
    rule)>
  permissions:
  - Microsoft.NotificationHubs/namespaces/notificationHubs/authorizationRules/listkeys/action
  conditions: []
  state_logic: "ACTIVE when the effective ARM permission is confirmed at the hub scope (resource, resource\
    \ group, or subscription). The ARM listKeys POST returns live key material immediately \u2014 no additional\
    \ conditions apply beyond the RBAC grant. BLOCKED when a deny assignment covers listkeys/action at\
    \ the effective scope."
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.NotificationHubs/namespaces/notificationHubs/authorizationRules/listkeys/action'
  - 'ContainsSecret: ?hub stores authorization rule with Send or Manage rights'
  - 'credential-chains.yaml: CredentialsFor links connection string to hub data-plane identity (if separately
    modeled)'
  false_positive_note: "ONLY the hub-level listkeys/action (on the notificationHubs/authorizationRules\
    \ path) returns hub Send/Manage keys. The namespace-level listkeys/action (on the namespaces/ authorizationRules\
    \ path) returns namespace SAS keys that control hub CRUD, NOT hub notification Send access \u2014\
    \ do not conflate the two. Confidence 0.95 because the listkeys response always returns key material\
    \ when the permission is granted, but the analyst must confirm the targeted rule carries Send or Manage\
    \ rights (not Listen-only, which is low-value). DefaultFullSharedAccessSignature is always present\
    \ and always carries Listen+Send+Manage. The returned connection string is a data-plane credential\
    \ for the hub, NOT a CSP identity credential \u2014 do not emit CredentialsFor to a CSP principal\
    \ without a confirmed separate link (e.g., the string stored in Key Vault with CredentialsFor to an\
    \ app identity)."
  narrative: "{principal.name} can call listKeys (notificationHubs/authorizationRules/listkeys/action)\
    \ on authorization rules of notification hub {target.name}; this returns the raw primaryKey, secondaryKey,\
    \ and connection strings including DefaultFullSharedAccessSignature, which grants full data-plane\
    \ access (Listen+Send+Manage) to the hub \u2014 enabling notification delivery to all registered devices\
    \ and read of all device registrations."