azure-sb-sender-role-writedata
Azure Service Bus Data Sender role (or Data Owner) grants data-plane send to a queue or topic; the primary Phase-10 publish primitive fed to messaging-chains.
match (effective permission)
{
"action": "Microsoft.ServiceBus/namespaces/messages/send/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Azure Service Bus Data Sender or Data Owner role on the namespace, queue, or topic (or a custom role granting messages/send/action)
emit
| source type | Identity |
|---|---|
| target type | Messaging |
| source | <principal> |
| target | <queue or topic (Queue or Topic node) in the namespace> |
| permissions | Microsoft.ServiceBus/namespaces/messages/send/action |
| state logic | ACTIVE when the effective permission is confirmed at the namespace, resource group, or subscription scope. BLOCKED if a deny assignment covers messages/send/action. When scoped to a specific queue or topic resource, only THAT entity is targeted; a namespace-scope role grants send to ALL queues and topics in the namespace. This CanWriteData feeds messaging-chains rule 1: CanWriteData(p, src) + CanTrigger(src, consumer) => CanTrigger(p, consumer). |
Narrative
{principal.name} holds the Azure Service Bus Data Sender role (messages/send/action) on {target.name} and can publish messages to this queue/topic; via messaging-chains, this CanWriteData feeds into CanTrigger(principal, consumer) for any consumer bound to the queue/topic.
Raw rule rules/derived/azure/servicebus.yaml
id: azure-sb-sender-role-writedata
emits: CanWriteData
description: Azure Service Bus Data Sender role (or Data Owner) grants data-plane send to a queue or topic;
the primary Phase-10 publish primitive fed to messaging-chains.
match_effective_permission:
action: Microsoft.ServiceBus/namespaces/messages/send/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Azure Service Bus Data Sender or Data Owner role on the namespace, queue,
or topic (or a custom role granting messages/send/action)
emit:
source_type: Identity
target_type: Messaging
source: <principal>
target: <queue or topic (Queue or Topic node) in the namespace>
permissions:
- Microsoft.ServiceBus/namespaces/messages/send/action
conditions: []
state_logic: 'ACTIVE when the effective permission is confirmed at the namespace, resource group, or
subscription scope. BLOCKED if a deny assignment covers messages/send/action. When scoped to a specific
queue or topic resource, only THAT entity is targeted; a namespace-scope role grants send to ALL queues
and topics in the namespace. This CanWriteData feeds messaging-chains rule 1: CanWriteData(p, src)
+ CanTrigger(src, consumer) => CanTrigger(p, consumer).'
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.ServiceBus/namespaces/messages/send/action'
- 'messaging-chains.yaml: messaging-publish-triggers-consumer (rule 1)'
false_positive_note: The Azure Service Bus Data Sender role grants messages/send/action but NOT messages/receive/action
or Manage actions. If the role is at namespace scope, all queues and topics in the namespace are targeted
(emit one CanWriteData per entity or model the namespace as the target). At queue/topic scope, restrict
to the specific entity. Do not conflate namespace-scope send with data-owner (which also grants receive
and manage).
narrative: '{principal.name} holds the Azure Service Bus Data Sender role (messages/send/action) on
{target.name} and can publish messages to this queue/topic; via messaging-chains, this CanWriteData
feeds into CanTrigger(principal, consumer) for any consumer bound to the queue/topic.'