azure-rediscache-write-can-attach-identity

redis/write permission allows attaching/replacing the managed identity used for CMK (data-at-rest encryption).

derived azure emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'cache': None}

where

node_type(?cache) == Cache ?cache.provider_type == 'Microsoft.Cache/redis' ?principal has EFFECTIVE Microsoft.Cache/redis/write at ?cache scope (Owner, Contributor, Redis Cache Contributor, or custom role with redis/write)

emit

source type	`Identity`
target type	`Data`
source	`?principal`
target	`?cache`
permissions	`Microsoft.Cache/redis/write`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy covers redis/write at the effective scope: BLOCKED; else ACTIVE if the cache is Premium tier with CMK enabled; CONDITIONAL if the cache does not have user-assigned MI or CMK is not configured (the CanAttachIdentity capability exists but has no impact until CMK + MI are present). The principal can modify the cache resource's managed identity property, swapping the user-assigned MI used for CMK (Premium tier with customer-managed keys). Replacing it with an attacker-controlled MI breaks existing data-at-rest access or redirects Key Vault decrypt calls to attacker infrastructure.

Narrative

{principal.name} holds Microsoft.Cache/redis/write on {cache.name}, enabling replacement of the managed identity assigned to the cache for CMK access (Premium tier). An attacker can swap the CMK MI to an attacker-controlled identity, breaking data access for existing clients or redirecting Key Vault decrypt operations.

Raw rule rules/derived/azure/rediscache.yaml

id: azure-rediscache-write-can-attach-identity
emits: CanAttachIdentity
description: redis/write permission allows attaching/replacing the managed identity used for CMK (data-at-rest
  encryption).
match:
- - principal: null
  - HasPermission
  - cache: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- ?principal has EFFECTIVE Microsoft.Cache/redis/write at ?cache scope (Owner, Contributor, Redis Cache
  Contributor, or custom role with redis/write)
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: ?cache
  permissions:
  - Microsoft.Cache/redis/write
  conditions:
  - iam_permission
  state_logic: 'if a deny assignment or deny Azure Policy covers redis/write at the effective scope: BLOCKED;
    else ACTIVE if the cache is Premium tier with CMK enabled; CONDITIONAL if the cache does not have
    user-assigned MI or CMK is not configured (the CanAttachIdentity capability exists but has no impact
    until CMK + MI are present). The principal can modify the cache resource''s managed identity property,
    swapping the user-assigned MI used for CMK (Premium tier with customer-managed keys). Replacing it
    with an attacker-controlled MI breaks existing data-at-rest access or redirects Key Vault decrypt
    calls to attacker infrastructure.'
  confidence: '0.90'
  derived_from:
  - <HasPermission edge_id (redis/write)>
  false_positive_note: CanAttachIdentity (for CMK) requires redis/write permission. This capability only
    applies to Premium tier caches with CMK and a user-assigned MI configured; Standard tier does not
    support customer-managed keys. Verify the cache has 'sku.tier == Premium' and the identity property
    is set before modeling this path. If CMK is not enabled, the AttachIdentity capability is present
    but has no functional impact.
  narrative: '{principal.name} holds Microsoft.Cache/redis/write on {cache.name}, enabling replacement
    of the managed identity assigned to the cache for CMK access (Premium tier). An attacker can swap
    the CMK MI to an attacker-controlled identity, breaking data access for existing clients or redirecting
    Key Vault decrypt operations.'