azure-rediscache-listkeys-exposes-credential

The Redis access keys are exposed via the cache resource whenever a principal with listKeys/action can retrieve them. This is a structural credential-exposure edge: the cache itself exposes the keys as a resource-level property, coupled with a principal's CanReadCredential permission.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Cache`
target type	`AccessKey`
source	`?cache`
target	`?accessKey`
state logic	ACTIVE (structural): {cache.name} holds and exposes primary and secondary access keys that authenticate to the Redis data-plane. This is an always-present structural property of the cache resource itself. A principal's ability to retrieve the key value is governed by a separate CanReadCredential edge conditioned on HasPermission(listKeys/action).

source type

Cache

target type

AccessKey

source

?cache

target

?accessKey

state logic

ACTIVE (structural): {cache.name} holds and exposes primary and secondary access keys that authenticate to the Redis data-plane. This is an always-present structural property of the cache resource itself. A principal's ability to *retrieve* the key value is governed by a separate CanReadCredential edge conditioned on HasPermission(listKeys/action).

Narrative

{cache.name} exposes primary and secondary Redis access keys that grant full data-plane access (read, write, delete, commands). These keys are always present on the resource and retrievable by any identity holding Microsoft.Cache/redis/listKeys/action via the ARM control-plane API.

Raw rule rules/derived/azure/rediscache.yaml

id: azure-rediscache-listkeys-exposes-credential
emits: ExposesCredential
description: 'The Redis access keys are exposed via the cache resource whenever a principal with listKeys/action
  can retrieve them. This is a structural credential-exposure edge: the cache itself exposes the keys
  as a resource-level property, coupled with a principal''s CanReadCredential permission.'
match:
- - cache: null
  - ContainsCredential
  - accessKey: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- node_type(?accessKey) == AccessKey
emit:
  source_type: Cache
  target_type: AccessKey
  source: ?cache
  target: ?accessKey
  permissions: []
  conditions: []
  state_logic: 'ACTIVE (structural): {cache.name} holds and exposes primary and secondary access keys
    that authenticate to the Redis data-plane. This is an always-present structural property of the cache
    resource itself. A principal''s ability to *retrieve* the key value is governed by a separate CanReadCredential
    edge conditioned on HasPermission(listKeys/action).'
  confidence: '1.0'
  derived_from:
  - "<ContainsCredential edge (cache \u2192 accessKey)>"
  false_positive_note: 'This edge models resource-level exposure only: the keys exist on the cache. A
    principal *using* the key requires the principal to hold CanReadCredential on the AccessKey (derived
    from listKeys/action permission), plus network reachability to the Redis data-plane endpoint. See
    azure-rediscache-listkeys-principal-read-credential and azure-rediscache-listkeys-can-read-data for
    principal paths.'
  narrative: '{cache.name} exposes primary and secondary Redis access keys that grant full data-plane
    access (read, write, delete, commands). These keys are always present on the resource and retrievable
    by any identity holding Microsoft.Cache/redis/listKeys/action via the ARM control-plane API.'