azure-sb-queue-listkeys

id: azure-sb-queue-listkeys
emits: CanReadSecret
description: Read the connection string of a queue-level SAS authorization rule; scoped to that queue
  only.
match_effective_permission:
  action: Microsoft.ServiceBus/namespaces/queues/authorizationRules/listKeys/action
  scope_type: resource|resourceGroup|subscription|queue
where:
- principal effectively holds the listKeys action at the queue or namespace scope
- at least one queue authorizationRule exists for the targeted queue
emit:
  source_type: Identity
  target_type: ConnectionString
  source: <principal>
  target: <SAS connection string (ConnectionString) for the queue auth rule>
  permissions:
  - Microsoft.ServiceBus/namespaces/queues/authorizationRules/listKeys/action
  conditions: []
  state_logic: "ACTIVE when the listKeys action is confirmed and at least one queue-level auth rule exists.\
    \ The resulting connection string is scoped to the targeted queue only \u2014 it does NOT grant access\
    \ to other queues or topics in the namespace. BLOCKED if a deny assignment covers this action. No-op\
    \ if disableLocalAuth=true on the namespace."
  confidence: 0.97
  derived_from:
  - 'effective permission: Microsoft.ServiceBus/namespaces/queues/authorizationRules/listKeys/action'
  - 'credential-chains.yaml: read-secret-yields-identity'
  false_positive_note: Queue-level SAS keys are NARROWER than namespace keys; a queue-scoped Send connection
    string grants send access only to THAT queue. Do not promote a queue-scoped key to a namespace-level
    CanWriteData covering other queues or topics. If the namespace has disableLocalAuth=true, all local
    auth (SAS) is disabled and listKeys returns no usable credential.
  narrative: '{principal.name} can call listKeys on a queue-level auth rule (queues/authorizationRules/listKeys/action)
    and obtain a SAS connection string scoped to that queue, granting data-plane access according to the
    rule''s claims without Entra RBAC.'