azure-rediscache-write-can-modify-config
redis/write permission allows modifying cache configuration including authentication settings, port exposure, TLS version, and managed identity for CMK.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?cache) ==
Cache
?cache.provider_type == 'Microsoft.Cache/redis'
?principal has EFFECTIVE Microsoft.Cache/redis/write at ?cache scope (Owner, Contributor, Redis Cache Contributor, or custom role with redis/write)
emit
| source type | Identity |
|---|---|
| target type | Cache |
| source | ?principal |
| target | ?cache |
| permissions | Microsoft.Cache/redis/write |
| conditions | iam_permission |
| state logic | if a deny assignment or deny Azure Policy covers redis/write at the effective scope: BLOCKED; else ACTIVE. The redis/write permission covers all cache properties including redisConfiguration (authnotrequired, enableNonSslPort, minimumTlsVersion), networkAcls / firewallRules, and managed identity assignment. Modifying these properties alters the attack surface and can enable unauthenticated access or redirect Key Vault access. This is the ARM-level configuration tampering capability. |
Narrative
{principal.name} holds Microsoft.Cache/redis/write on {cache.name}, enabling modification of all cache configuration properties: disabling Redis authentication (authnotrequired), enabling unencrypted port 6379 (enableNonSslPort), lowering TLS version (minimumTlsVersion), and changing the managed identity for CMK (CanAttachIdentity). These changes directly expand the attack surface.
Raw rule rules/derived/azure/rediscache.yaml
id: azure-rediscache-write-can-modify-config
emits: CanModifyConfiguration
description: redis/write permission allows modifying cache configuration including authentication settings,
port exposure, TLS version, and managed identity for CMK.
match:
- - principal: null
- HasPermission
- cache: null
where:
- node_type(?cache) == Cache
- ?cache.provider_type == 'Microsoft.Cache/redis'
- ?principal has EFFECTIVE Microsoft.Cache/redis/write at ?cache scope (Owner, Contributor, Redis Cache
Contributor, or custom role with redis/write)
emit:
source_type: Identity
target_type: Cache
source: ?principal
target: ?cache
permissions:
- Microsoft.Cache/redis/write
conditions:
- iam_permission
state_logic: 'if a deny assignment or deny Azure Policy covers redis/write at the effective scope: BLOCKED;
else ACTIVE. The redis/write permission covers all cache properties including redisConfiguration (authnotrequired,
enableNonSslPort, minimumTlsVersion), networkAcls / firewallRules, and managed identity assignment.
Modifying these properties alters the attack surface and can enable unauthenticated access or redirect
Key Vault access. This is the ARM-level configuration tampering capability.'
confidence: '0.95'
derived_from:
- <HasPermission edge_id (redis/write)>
false_positive_note: The Redis Cache Contributor and Contributor/Owner roles include redis/write. Configuration
changes via PATCH are immediate and observable in the cache properties. CanModifyConfiguration gates
the can-control linchpin rule which derives Controls. Do NOT confuse with CanModifyCode (which is
not applicable to Redis, a passive data store).
narrative: '{principal.name} holds Microsoft.Cache/redis/write on {cache.name}, enabling modification
of all cache configuration properties: disabling Redis authentication (authnotrequired), enabling
unencrypted port 6379 (enableNonSslPort), lowering TLS version (minimumTlsVersion), and changing the
managed identity for CMK (CanAttachIdentity). These changes directly expand the attack surface.'