azure-postgres-mysql-entra-admin-readdata

id: azure-postgres-mysql-entra-admin-readdata
emits: CanReadData
description: Entra admin assignment (CanModifyConfiguration) plus network reachability to the DB endpoint
  yields full data-plane read of all databases via Entra token authentication.
match:
- - principal: null
  - CanModifyConfiguration
  - server: null
where:
- node_class(?server) == Data and node_type(?server) == RelationalDatabase
- node_type(?server) matched provider_type in ['Microsoft.DBforPostgreSQL/flexibleServers', 'Microsoft.DBforMySQL/flexibleServers']
- ?server.properties.authConfig.activeDirectoryAuth == 'Enabled'
- edge produced by azure-postgres-mysql-entra-admin-set (CanModifyConfiguration from administrators/write
  on this server)
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  permissions:
  - Microsoft.DBforPostgreSQL/flexibleServers/administrators/write
  - Microsoft.DBforMySQL/flexibleServers/administrators/write
  conditions:
  - network_reachability
  - service_state
  state_logic: "if ?server.properties.publicNetworkAccess == 'Disabled' (private-access topology / VNet\
    \ injection): CONDITIONAL(network_reachability) \u2014 no public endpoint exists; attacker must have\
    \ a foothold in the delegated subnet or a peered VNet to reach port 5432/3306; elif ?server.properties.publicNetworkAccess\
    \ == 'Enabled' AND a firewall rule admitting the attacker's source IP exists (or rule 0.0.0.0\u2013\
    255.255.255.255): ACTIVE; elif ?server.properties.publicNetworkAccess == 'Enabled' AND no firewall\
    \ rule covers the attacker's source: CONDITIONAL(network_reachability); if authConfig.activeDirectoryAuth\
    \ != 'Enabled': DO NOT EMIT (the Entra admin identity cannot authenticate); if a deny assignment or\
    \ deny Azure Policy covers administrators/write at effective scope (blocking the upstream CanModifyConfiguration):\
    \ BLOCKED."
  confidence: '0.88'
  derived_from:
  - 'CanModifyConfiguration edge: source=?principal, target=?server, rule=azure-postgres-mysql-entra-admin-set'
  false_positive_note: "CRITICAL: Entra AD authentication MUST be enabled on the server (authConfig.activeDirectoryAuth\
    \ == 'Enabled'). If it is disabled, the Entra admin is set at the control plane but cannot authenticate\
    \ at the data plane \u2014 emit BLOCKED or DO NOT EMIT. Network reachability is a HARD gate. A private-access\
    \ server (VNet-injected, publicNetworkAccess == Disabled) has no public endpoint \u2014 do NOT emit\
    \ ACTIVE unless the principal is provably inside the VNet or peered network. For public-access servers:\
    \ only ACTIVE when a firewall rule admits the attacker's source IP; the rule range 0.0.0.0\u2013255.255.255.255\
    \ means any internet host, which yields ACTIVE."
  narrative: '{principal.name} can set an Entra AD administrator on {server.name} (via flexibleServers/administrators/write),
    and Entra authentication is enabled on the server (authConfig.activeDirectoryAuth == ''Enabled'').
    Combined with network reachability to the database endpoint, the attacker (or the designated Entra
    principal) can authenticate using an Entra access token and gain database-level admin privileges,
    reading all databases and tables.'