azure-sb-namespace-sas-contains

A Service Bus namespace with active SAS authorization rules embeds connection-string credentials usable at data-plane without Entra RBAC.

derived azure emits ContainsSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`GenericMessaging`
target type	`ConnectionString`
source	`?namespace`
target	`<SAS ConnectionString node for the namespace auth rule>`
state logic	ACTIVE when the namespace has at least one auth rule with a non-empty primary or secondary key AND disableLocalAuth is false. This is a structural credential-existence fact, not a read capability. BLOCKED if disableLocalAuth=true (no SAS keys usable). Derives ExposesCredential (via credential-chains) when paired with the listKeys-granted CanReadSecret or when the connection string is found embedded in a consumer's appsettings.

source type

GenericMessaging

target type

ConnectionString

source

?namespace

target

<SAS ConnectionString node for the namespace auth rule>

state logic

ACTIVE when the namespace has at least one auth rule with a non-empty primary or secondary key AND disableLocalAuth is false. This is a structural credential-existence fact, not a read capability. BLOCKED if disableLocalAuth=true (no SAS keys usable). Derives ExposesCredential (via credential-chains) when paired with the listKeys-granted CanReadSecret or when the connection string is found embedded in a consumer's appsettings.

Narrative

Service Bus namespace {namespace.name} has active SAS authorization rules whose connection strings grant data-plane access; these connection strings are credentials that bypass Entra RBAC and are readable by any principal with the listKeys action.

Raw rule rules/derived/azure/servicebus.yaml

id: azure-sb-namespace-sas-contains
emits: ContainsSecret
description: A Service Bus namespace with active SAS authorization rules embeds connection-string credentials
  usable at data-plane without Entra RBAC.
match:
- - namespace: null
  - HasPolicy
  - authrule: null
where:
- node_type(?namespace) == GenericMessaging
- node_type(?authrule) == ResourcePolicy
- ?authrule is a Microsoft.ServiceBus/namespaces/authorizationRules entry with at least one active key
- namespace.disableLocalAuth != true
emit:
  source_type: GenericMessaging
  target_type: ConnectionString
  source: ?namespace
  target: <SAS ConnectionString node for the namespace auth rule>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the namespace has at least one auth rule with a non-empty primary or secondary
    key AND disableLocalAuth is false. This is a structural credential-existence fact, not a read capability.
    BLOCKED if disableLocalAuth=true (no SAS keys usable). Derives ExposesCredential (via credential-chains)
    when paired with the listKeys-granted CanReadSecret or when the connection string is found embedded
    in a consumer's appsettings.
  confidence: 0.95
  derived_from:
  - Microsoft.ServiceBus/namespaces/authorizationRules (existence of active rules)
  - 'credential-chains.yaml: ExposesCredential feeds CanImpersonate via CredentialsFor'
  false_positive_note: "This edge asserts that the namespace STORES SAS credentials, not that any specific\
    \ principal can read them. The path to exploitation requires either (a) CanReadSecret via listKeys/action,\
    \ or (b) the connection string is already embedded in a consumer's appsettings (modeled as ContainsSecret\
    \ on the consumer by the consumer adapter). Do not conflate the existence of an auth rule with unauthorized\
    \ access \u2014 the rule's keys are protected by ARM RBAC (listKeys action). If disableLocalAuth=true,\
    \ no SAS keys are active even if auth rules appear in the ARM resource list."
  narrative: Service Bus namespace {namespace.name} has active SAS authorization rules whose connection
    strings grant data-plane access; these connection strings are credentials that bypass Entra RBAC and
    are readable by any principal with the listKeys action.