azure-postgres-mysql-admin-password-reset

ARM write on the server resource sets/resets the native administrator password, enabling full DB access after network reach.

derived azure emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'server': None}

where

node_class(?server) == Data and node_type(?server) == RelationalDatabase node_type(?server) matched provider_type in ['Microsoft.DBforPostgreSQL/flexibleServers', 'Microsoft.DBforMySQL/flexibleServers'] ?principal has EFFECTIVE Microsoft.DBforPostgreSQL/flexibleServers/write OR Microsoft.DBforMySQL/flexibleServers/write (as applicable) at ?server scope (Contributor, Owner, or custom role including flexibleServers/write)

emit

source type	`Identity`
target type	`RelationalDatabase`
source	`?principal`
target	`?server`
permissions	`Microsoft.DBforPostgreSQL/flexibleServers/write` `Microsoft.DBforMySQL/flexibleServers/write`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy covers flexibleServers/write at the effective scope: BLOCKED; else ACTIVE. This is an ARM control-plane call; it is NOT gated by the server firewall rules or publicNetworkAccess setting — the ARM update action succeeds from any network regardless of DB network configuration. Password reset is destructive and detectable via Azure Activity Log; state is ACTIVE for the capability itself.

Narrative

{principal.name} can call the ARM update action on {server.name} (Microsoft.DBforPostgreSQL/flexibleServers/write or Microsoft.DBforMySQL/flexibleServers/write), which allows setting the native administrator password to an attacker-chosen value. After the reset, the attacker can authenticate directly to the database engine as the admin user (port 5432 for PostgreSQL, port 3306 for MySQL), subject to network reachability.

Raw rule rules/derived/azure/postgres-mysql.yaml

id: azure-postgres-mysql-admin-password-reset
emits: CanModifyConfiguration
description: ARM write on the server resource sets/resets the native administrator password, enabling
  full DB access after network reach.
match:
- - principal: null
  - HasPermission
  - server: null
where:
- node_class(?server) == Data and node_type(?server) == RelationalDatabase
- node_type(?server) matched provider_type in ['Microsoft.DBforPostgreSQL/flexibleServers', 'Microsoft.DBforMySQL/flexibleServers']
- ?principal has EFFECTIVE Microsoft.DBforPostgreSQL/flexibleServers/write OR Microsoft.DBforMySQL/flexibleServers/write
  (as applicable) at ?server scope (Contributor, Owner, or custom role including flexibleServers/write)
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  permissions:
  - Microsoft.DBforPostgreSQL/flexibleServers/write
  - Microsoft.DBforMySQL/flexibleServers/write
  conditions:
  - iam_permission
  state_logic: "if a deny assignment or deny Azure Policy covers flexibleServers/write at the effective\
    \ scope: BLOCKED; else ACTIVE. This is an ARM control-plane call; it is NOT gated by the server firewall\
    \ rules or publicNetworkAccess setting \u2014 the ARM update action succeeds from any network regardless\
    \ of DB network configuration. Password reset is destructive and detectable via Azure Activity Log;\
    \ state is ACTIVE for the capability itself."
  confidence: '0.95'
  derived_from:
  - 'HasPermission edge: source=?principal, target=?server, action=(Microsoft.DBforPostgreSQL/flexibleServers/write
    | Microsoft.DBforMySQL/flexibleServers/write)'
  false_positive_note: "Verify effective permissions via role definition resolution \u2014 Contributor\
    \ and Owner include flexibleServers/write; Reader does NOT. Do NOT infer write access from resource\
    \ group or subscription Reader grants. This action resets (overwrites) the existing admin password\
    \ \u2014 the previous holder of the admin credential loses access. Emit BLOCKED only when a deny assignment\
    \ or deny Azure Policy deny-effect covers flexibleServers/write at the effective scope. The ARM write\
    \ action is callable from any network regardless of the server's firewall rules or publicNetworkAccess\
    \ setting \u2014 do NOT apply a network_reachability condition to this rule. IMPORTANT: there is no\
    \ 'listAdminPassword' or 'listKeys' equivalent for these services \u2014 the password is write-only\
    \ (reset), not readable. CanModifyConfiguration represents control-plane configuration authority over\
    \ the server's authentication settings. Downstream derivation (azure-postgres-mysql-admin-reset-readdata)\
    \ chains to CanReadData when network reach is available."
  narrative: '{principal.name} can call the ARM update action on {server.name} (Microsoft.DBforPostgreSQL/flexibleServers/write
    or Microsoft.DBforMySQL/flexibleServers/write), which allows setting the native administrator password
    to an attacker-chosen value. After the reset, the attacker can authenticate directly to the database
    engine as the admin user (port 5432 for PostgreSQL, port 3306 for MySQL), subject to network reachability.'