azure-sb-administer
Full control of a Service Bus namespace (Contributor / Owner at namespace scope; NOT Service Bus Data Owner which lacks ARM write).
match (effective permission)
{
"action": "Microsoft.ServiceBus/namespaces/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor or Owner role (or a custom role granting Microsoft.ServiceBus/namespaces/write) at the namespace scope
NOTE: Azure Service Bus Data Owner role does NOT include Microsoft.ServiceBus/namespaces/write (ARM control plane) and should NOT appear in this rule
emit
| source type | Identity |
|---|---|
| target type | GenericMessaging |
| source | <principal> |
| target | <Service Bus namespace> |
| permissions | Microsoft.ServiceBus/namespaces/write |
| state logic | ACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers namespaces/write at the effective scope. This does NOT imply Microsoft.Authorization/*/write — escalation via Service Bus is through the namespace's SAS keys or by triggering consumers bound to it, not through self role-assignment. |
Narrative
{principal.name} has full control of Service Bus namespace {target.name} (Microsoft.ServiceBus/namespaces/write), including creating/deleting queues and topics, modifying auth rules, and changing network access settings.
Raw rule rules/derived/azure/servicebus.yaml
id: azure-sb-administer
emits: CanAdminister
description: Full control of a Service Bus namespace (Contributor / Owner at namespace scope; NOT Service
Bus Data Owner which lacks ARM write).
match_effective_permission:
action: Microsoft.ServiceBus/namespaces/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor or Owner role (or a custom role granting Microsoft.ServiceBus/namespaces/write)
at the namespace scope
- 'NOTE: Azure Service Bus Data Owner role does NOT include Microsoft.ServiceBus/namespaces/write (ARM
control plane) and should NOT appear in this rule'
emit:
source_type: Identity
target_type: GenericMessaging
source: <principal>
target: <Service Bus namespace>
permissions:
- Microsoft.ServiceBus/namespaces/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers\
\ namespaces/write at the effective scope. This does NOT imply Microsoft.Authorization/*/write \u2014\
\ escalation via Service Bus is through the namespace's SAS keys or by triggering consumers bound\
\ to it, not through self role-assignment."
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.ServiceBus/namespaces/write'
false_positive_note: namespaces/write grants control of the namespace object including queues, topics,
auth rules, and network rule sets. It does NOT imply Microsoft.Authorization/*/write (role assignment).
The Azure Service Bus Data Owner role includes all data-plane actions (send, receive, manage) and
the listKeys action but NOT namespaces/write for ARM resource modification; Contributor/Owner is required
for ARM-level write. Confirm which role the principal holds before asserting CanAdminister.
narrative: '{principal.name} has full control of Service Bus namespace {target.name} (Microsoft.ServiceBus/namespaces/write),
including creating/deleting queues and topics, modifying auth rules, and changing network access settings.'