azure-sb-sas-receive-readdata

id: azure-sb-sas-receive-readdata
emits: CanReadData
description: "Holding a SAS connection string with Listen rights grants data-plane receive from the scoped\
  \ queue/subscription \u2014 messages may carry secrets."
match:
- - principal: null
  - CanReadSecret
  - connstr: null
where:
- node_type(?connstr) == ConnectionString
- ?connstr is a Service Bus SAS connection string whose rights include Listen or Manage
- ?entity is the namespace, queue, or topic subscription scoped by the connection string
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: <queue or topic subscription (Queue) scoped by ?connstr>
  permissions: []
  conditions: []
  state_logic: ACTIVE when CanReadSecret(?principal, ?connstr) is ACTIVE AND the connection string's rights
    include 'Listen' or 'Manage'. Inherits state from the contributing CanReadSecret. BLOCKED if disableLocalAuth=true.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal CanReadSecret ?connstr (azure-sb-namespace-listkeys or queue/topic equivalents)
  - connection string rights array includes 'Listen' or 'Manage'
  - 'credential-chains.yaml: CanReadData on a source ContainsSecret => can read secrets in messages'
  false_positive_note: 'Only emit when the rights array contains ''Listen'' or ''Manage''. A Send-only
    SAS key does NOT grant receive. Honor the scope: a topic-scoped Listen SAS does not directly grant
    receive from a subscription (subscriptions have their own entity path; verify the entityPath in the
    connection string).'
  narrative: '{principal.name} obtained a SAS connection string for {target.name} with Listen rights (via
    listKeys); this credential grants data-plane receive from {target.name} without Entra RBAC; messages
    received may carry credential material (ContainsSecret chain).'