rage.fail

azure-openai-account-contains-keys

explicit azure emits ContainsCredential

match (record)

{ "field": "properties.disableLocalAuth", "resource_type": "Microsoft.CognitiveServices/accounts" }

where

properties.disableLocalAuth != true # key-based auth is enabled (default)

emit

source type	`GenericData`
target type	`Credential`
source	`<CognitiveServices account node>`
target	`<Credential: account API keys (primary and secondary)>`

Narrative

Azure OpenAI account {account.name} holds symmetric API keys (primary and secondary) that authenticate to all model deployments in the account. Keys are available because disableLocalAuth is false or unset (default behavior). Key-based authentication bypasses Entra RBAC data-plane role assignments.

Raw rule rules/explicit/azure-openai.yaml

id: azure-openai-account-contains-keys
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.CognitiveServices/accounts
  field: properties.disableLocalAuth
where:
- 'properties.disableLocalAuth != true  # key-based auth is enabled (default)'
emit:
  source_type: GenericData
  target_type: Credential
  source: <CognitiveServices account node>
  target: '<Credential: account API keys (primary and secondary)>'
  api_source: Microsoft.CognitiveServices/accounts GET (properties.disableLocalAuth)
  evidence_field: properties.disableLocalAuth
  narrative: Azure OpenAI account {account.name} holds symmetric API keys (primary and secondary) that
    authenticate to all model deployments in the account. Keys are available because disableLocalAuth
    is false or unset (default behavior). Key-based authentication bypasses Entra RBAC data-plane role
    assignments.