azure-sb-topic-listkeys
Read the connection string of a topic-level SAS authorization rule; scoped to that topic only.
match (effective permission)
{
"action": "Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys/action",
"scope_type": "resource|resourceGroup|subscription|topic"
}
where
principal effectively holds the listKeys action at the topic or namespace scope
at least one topic authorizationRule exists for the targeted topic
emit
| source type | Identity |
|---|---|
| target type | ConnectionString |
| source | <principal> |
| target | <SAS connection string (ConnectionString) for the topic auth rule> |
| permissions | Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys/action |
| state logic | ACTIVE when the listKeys action is confirmed and at least one topic-level auth rule exists. The resulting connection string is scoped to the targeted topic — does NOT grant access to other topics or queues. BLOCKED if a deny assignment covers this action. No-op if disableLocalAuth=true. |
Narrative
{principal.name} can call listKeys on a topic-level auth rule (topics/authorizationRules/listKeys/action) and obtain a SAS connection string scoped to that topic.
Raw rule rules/derived/azure/servicebus.yaml
id: azure-sb-topic-listkeys
emits: CanReadSecret
description: Read the connection string of a topic-level SAS authorization rule; scoped to that topic
only.
match_effective_permission:
action: Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys/action
scope_type: resource|resourceGroup|subscription|topic
where:
- principal effectively holds the listKeys action at the topic or namespace scope
- at least one topic authorizationRule exists for the targeted topic
emit:
source_type: Identity
target_type: ConnectionString
source: <principal>
target: <SAS connection string (ConnectionString) for the topic auth rule>
permissions:
- Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys/action
conditions: []
state_logic: "ACTIVE when the listKeys action is confirmed and at least one topic-level auth rule exists.\
\ The resulting connection string is scoped to the targeted topic \u2014 does NOT grant access to\
\ other topics or queues. BLOCKED if a deny assignment covers this action. No-op if disableLocalAuth=true."
confidence: 0.97
derived_from:
- 'effective permission: Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys/action'
- 'credential-chains.yaml: read-secret-yields-identity'
false_positive_note: Topic-scoped SAS keys are narrower than namespace keys. A Send-only topic key does
not grant Listen. A Listen-only key does not grant publish. Honor the rights array. Do not promote
topic-scoped keys to namespace-wide CanWriteData. disableLocalAuth=true makes this a no-op.
narrative: '{principal.name} can call listKeys on a topic-level auth rule (topics/authorizationRules/listKeys/action)
and obtain a SAS connection string scoped to that topic.'