azure-sb-queue-sas-contains

A Service Bus queue with active entity-level SAS authorization rules embeds queue-scoped connection-string credentials usable at data-plane without Entra RBAC.

derived azure emits ContainsSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Queue`
target type	`ConnectionString`
source	`?queue`
target	`<SAS ConnectionString node for the queue auth rule>`
state logic	ACTIVE when the queue has at least one auth rule with a non-empty primary or secondary key AND the parent namespace has disableLocalAuth=false. This is a structural credential-existence fact at queue scope, narrower than namespace-level SAS keys. BLOCKED if disableLocalAuth=true. Derives CanReadSecret (via azure-sb-queue-listkeys) when paired with queue-level listKeys permission.

source type

Queue

target type

ConnectionString

source

?queue

target

<SAS ConnectionString node for the queue auth rule>

state logic

ACTIVE when the queue has at least one auth rule with a non-empty primary or secondary key AND the parent namespace has disableLocalAuth=false. This is a structural credential-existence fact at queue scope, narrower than namespace-level SAS keys. BLOCKED if disableLocalAuth=true. Derives CanReadSecret (via azure-sb-queue-listkeys) when paired with queue-level listKeys permission.

Narrative

Service Bus queue {queue.name} has active SAS authorization rules whose connection strings grant data-plane access scoped to this queue; these connection strings are credentials readable by any principal with the queue-level listKeys action.

Raw rule rules/derived/azure/servicebus.yaml

id: azure-sb-queue-sas-contains
emits: ContainsSecret
description: A Service Bus queue with active entity-level SAS authorization rules embeds queue-scoped
  connection-string credentials usable at data-plane without Entra RBAC.
match:
- - queue: null
  - HasPolicy
  - authrule: null
where:
- node_type(?queue) == Queue
- node_type(?authrule) == ResourcePolicy
- ?authrule is a Microsoft.ServiceBus/namespaces/queues/authorizationRules entry with at least one active
  key
- queue.parent.namespace.disableLocalAuth != true
emit:
  source_type: Queue
  target_type: ConnectionString
  source: ?queue
  target: <SAS ConnectionString node for the queue auth rule>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the queue has at least one auth rule with a non-empty primary or secondary
    key AND the parent namespace has disableLocalAuth=false. This is a structural credential-existence
    fact at queue scope, narrower than namespace-level SAS keys. BLOCKED if disableLocalAuth=true. Derives
    CanReadSecret (via azure-sb-queue-listkeys) when paired with queue-level listKeys permission.
  confidence: 0.95
  derived_from:
  - Microsoft.ServiceBus/namespaces/queues/authorizationRules (existence of active rules)
  false_positive_note: "Queue-level SAS keys are scoped to that queue only \u2014 they do NOT grant access\
    \ to other queues or topics in the namespace. This edge asserts the queue STORES SAS credentials at\
    \ entity scope. Exploitation requires either (a) CanReadSecret via queue-level listKeys/action, or\
    \ (b) the connection string is embedded in a consumer's appsettings. Do not conflate the existence\
    \ of a queue auth rule with unauthorized access."
  narrative: Service Bus queue {queue.name} has active SAS authorization rules whose connection strings
    grant data-plane access scoped to this queue; these connection strings are credentials readable by
    any principal with the queue-level listKeys action.