azure-sb-queue-triggers-consumer

id: azure-sb-queue-triggers-consumer
emits: CanTrigger
description: "A confirmed event-source binding from a Service Bus queue to a compute consumer (Azure Function\
  \ serviceBusTrigger, Logic App connector, Container App KEDA scaler) \u2014 the Phase-10 binding fact."
match:
- - queue: null
  - LocatedIn
  - namespace: null
where:
- node_type(?queue) == Queue
- node_type(?namespace) == GenericMessaging
- a confirmed event-source binding exists routing ?queue to ?consumer (e.g. Function serviceBusTrigger
  with entityPath=?queue.name, Logic App Service Bus trigger, Container App KEDA azure-servicebus trigger)
- the binding is active/enabled (Function running and enabled, Logic App enabled, KEDA scaler active)
emit:
  source_type: Queue
  target_type: Compute
  source: ?queue
  target: <compute consumer (ServerlessFunction / ContainerService / Workflow) bound to ?queue>
  permissions: []
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when the event-source binding is confirmed present and the consumer is running/enabled
    (the Function app is in Running state, the Logic App workflow is enabled, the Container App is running
    with the KEDA scaler active). CONDITIONAL(trigger_exists) when the binding configuration exists but
    the consumer is stopped or the binding is disabled. CONDITIONAL( service_state) when the consumer
    app is stopped but CanStart is held by the attacker. This edge is consumed by messaging-chains rule
    1 together with CanWriteData(principal, queue) to produce CanTrigger(principal, consumer). messaging-chains
    rule 2 then collapses CanTrigger(p, consumer) + ExecutesAs(consumer, MI) => CanExecuteAs(p, MI).
  confidence: 0.95
  derived_from:
  - event-source binding fact (serviceBusTrigger config / Logic App trigger / KEDA spec)
  - 'messaging-chains.yaml: messaging-publish-triggers-consumer (rule 1) and messaging-trigger-executes-as
    (rule 2)'
  false_positive_note: 'Only emit ACTIVE when the binding is confirmed LIVE: the Function app is Running
    AND the Service Bus trigger extension is enabled AND the entityPath matches the queue name AND the
    connection setting resolves to the correct namespace. A stopped Function, a disabled trigger binding,
    or a filter predicate the attacker payload cannot satisfy downgrades to CONDITIONAL. Logic App: the
    workflow trigger must be enabled; a disabled Logic App workflow is CONDITIONAL(service_state). Container
    App: the KEDA scaler must be active and the namespace reachable. Do NOT emit for dead-letter-only
    flows that never invoke compute.'
  narrative: Service Bus queue {queue.name} is bound as an event source to consumer {target.name}; messages
    published to {queue.name} trigger {target.name} to execute with an attacker-influenced payload via
    the event-source binding.