azure-sb-receiver-role-readdata

id: azure-sb-receiver-role-readdata
emits: CanReadData
description: Azure Service Bus Data Receiver role (or Data Owner) grants data-plane receive from a queue
  or subscription; messages may carry secrets.
match_effective_permission:
  action: Microsoft.ServiceBus/namespaces/messages/receive/action
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Azure Service Bus Data Receiver or Data Owner role on the namespace, queue,
  or topic/subscription
emit:
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <queue or topic subscription (Queue node) in the namespace>
  permissions:
  - Microsoft.ServiceBus/namespaces/messages/receive/action
  conditions: []
  state_logic: 'ACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers
    messages/receive/action. Scoped analogously to send: namespace-scope role covers all entities; entity-scope
    role covers only that entity. Feeds credential-chains when the queue ContainsSecret (a message carrying
    credential material).'
  confidence: 0.97
  derived_from:
  - 'effective permission: Microsoft.ServiceBus/namespaces/messages/receive/action'
  - 'credential-chains.yaml: CanReadData on a source ContainsSecret => CanReadSecret => CanImpersonate'
  false_positive_note: "Data Receiver grants receive but NOT send. Receiving messages from a queue/subscription\
    \ is a data-read action; escalation only occurs if the messages themselves carry credentials (ContainsSecret\
    \ on the queue/topic) or if the receiver can use received data to pivot (rare). Do not equate receive\
    \ rights with trigger rights \u2014 a Receiver cannot publish messages and therefore cannot trigger\
    \ consumers via the messaging chain."
  narrative: '{principal.name} holds the Azure Service Bus Data Receiver role (messages/receive/action)
    on {target.name} and can dequeue/peek messages; if messages carry credential material (ContainsSecret),
    credential-chains rolls this into CanReadSecret and potentially CanImpersonate.'