rage.fail

azure-rediscache-access-key-credential

explicit azure emits ContainsCredential

match (record)

{ "resource_type": "Microsoft.Cache/redis" }

emit

source type	`Cache`
target type	`AccessKey`
source	`<Redis cache node (Cache generic_type)>`
target	`<AccessKey node — primary and secondary Redis access keys>`

Narrative

{cache.name} holds primary and secondary access keys that authenticate to the Redis data-plane (full read/write). The keys are retrievable via listKeys/action by any identity with that ARM RBAC permission.

Raw rule rules/explicit/azure-rediscache.yaml

id: azure-rediscache-access-key-credential
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.Cache/redis
emit:
  source_type: Cache
  target_type: AccessKey
  source: <Redis cache node (Cache generic_type)>
  target: "<AccessKey node \u2014 primary and secondary Redis access keys>"
  api_source: GET https://management.azure.com/.../Microsoft.Cache/redis/{name}
  evidence_field: Existence of the cache resource (keys are always present as long as authentication is
    required). Key VALUES are not retrieved by the read-only collector; existence is inferred from the
    cache resource being active and having authentication enabled (authnotrequired != 'yes').
  narrative: '{cache.name} holds primary and secondary access keys that authenticate to the Redis data-plane
    (full read/write). The keys are retrievable via listKeys/action by any identity with that ARM RBAC
    permission.'