azure-sb-namespace-listkeys
Read the primary and secondary connection strings of a namespace-level SAS authorization rule via listKeys; the connection string grants the rule's claims (Send/Listen/Manage) data-plane-wide.
match (effective permission)
{
"action": "Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds the listKeys action at the namespace scope
at least one namespace authorizationRule exists
emit
| source type | Identity |
|---|---|
| target type | ConnectionString |
| source | <principal> |
| target | <SAS connection string (ConnectionString) for the namespace auth rule> |
| permissions | Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action |
| state logic | ACTIVE when the listKeys action is confirmed (not merely /read) and at least one authorization rule exists in the namespace. BLOCKED if a deny assignment covers listKeys/action at the effective scope. Note: Reader role does NOT include listKeys/action; a custom role or Contributor/Owner (or the Azure Service Bus Data Owner role, which includes the management API) is required. A namespace with NO auth rules yields no connection string (Entra-only mode, `disableLocalAuth=true`) — do not emit if local auth is disabled. |
Narrative
{principal.name} can call listKeys on a Service Bus namespace auth rule (authorizationRules/listKeys/action) and obtain the primary/secondary connection string, which is a SAS credential granting data-plane access to the entire namespace according to the rule's configured claims (Send/Listen/Manage) without Entra RBAC.
Raw rule rules/derived/azure/servicebus.yaml
id: azure-sb-namespace-listkeys
emits: CanReadSecret
description: Read the primary and secondary connection strings of a namespace-level SAS authorization
rule via listKeys; the connection string grants the rule's claims (Send/Listen/Manage) data-plane-wide.
match_effective_permission:
action: Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds the listKeys action at the namespace scope
- at least one namespace authorizationRule exists
emit:
source_type: Identity
target_type: ConnectionString
source: <principal>
target: <SAS connection string (ConnectionString) for the namespace auth rule>
permissions:
- Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action
conditions: []
state_logic: "ACTIVE when the listKeys action is confirmed (not merely /read) and at least one authorization\
\ rule exists in the namespace. BLOCKED if a deny assignment covers listKeys/action at the effective\
\ scope. Note: Reader role does NOT include listKeys/action; a custom role or Contributor/Owner (or\
\ the Azure Service Bus Data Owner role, which includes the management API) is required. A namespace\
\ with NO auth rules yields no connection string (Entra-only mode, `disableLocalAuth=true`) \u2014\
\ do not emit if local auth is disabled."
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action'
- 'credential-chains.yaml: read-secret-yields-identity (CanReadSecret + CredentialsFor => CanImpersonate)'
false_positive_note: "listKeys/action is a POST action that returns the actual key material (primaryKey,\
\ secondaryKey, primaryConnectionString, secondaryConnectionString). authorizationRules/read alone\
\ enumerates rule names but NOT keys \u2014 do not emit CanReadSecret for read-only enumeration. If\
\ `disableLocalAuth=true` (Entra-only mode), no SAS keys are active and this rule is a no-op even\
\ if the listKeys action is theoretically grantable. Honor the rule's claims (rights): a rule with\
\ only Manage rights grants management actions; a Send rule grants publish only. Each rule's connection\
\ string is a separate ConnectionString node scoped to its claims."
narrative: '{principal.name} can call listKeys on a Service Bus namespace auth rule (authorizationRules/listKeys/action)
and obtain the primary/secondary connection string, which is a SAS credential granting data-plane
access to the entire namespace according to the rule''s configured claims (Send/Listen/Manage) without
Entra RBAC.'