azure-sb-topic-sas-contains

A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped connection-string credentials usable at data-plane without Entra RBAC.

derived azure emits ContainsSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Topic`
target type	`ConnectionString`
source	`?topic`
target	`<SAS ConnectionString node for the topic auth rule>`
state logic	ACTIVE when the topic has at least one auth rule with a non-empty primary or secondary key AND the parent namespace has disableLocalAuth=false. This is a structural credential-existence fact at topic scope. BLOCKED if disableLocalAuth=true. Derives CanReadSecret when paired with topic-level listKeys permission (azure-sb-topic-listkeys).

source type

Topic

target type

ConnectionString

source

?topic

target

<SAS ConnectionString node for the topic auth rule>

state logic

ACTIVE when the topic has at least one auth rule with a non-empty primary or secondary key AND the parent namespace has disableLocalAuth=false. This is a structural credential-existence fact at topic scope. BLOCKED if disableLocalAuth=true. Derives CanReadSecret when paired with topic-level listKeys permission (azure-sb-topic-listkeys).

Narrative

Service Bus topic {topic.name} has active SAS authorization rules whose connection strings grant data-plane access scoped to this topic; these connection strings are credentials readable by any principal with the topic-level listKeys action.

Raw rule rules/derived/azure/servicebus.yaml

id: azure-sb-topic-sas-contains
emits: ContainsSecret
description: A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped
connection-string credentials usable at data-plane without Entra RBAC.
match:
- - topic: null
- HasPolicy
- authrule: null
where:
- node_type(?topic) == Topic
- node_type(?authrule) == ResourcePolicy
- ?authrule is a Microsoft.ServiceBus/namespaces/topics/authorizationRules entry with at least one active
key
- topic.parent.namespace.disableLocalAuth != true
emit:
source_type: Topic
target_type: ConnectionString
source: ?topic
target: <SAS ConnectionString node for the topic auth rule>
permissions: []
conditions: []
state_logic: ACTIVE when the topic has at least one auth rule with a non-empty primary or secondary
key AND the parent namespace has disableLocalAuth=false. This is a structural credential-existence
fact at topic scope. BLOCKED if disableLocalAuth=true. Derives CanReadSecret when paired with topic-level
listKeys permission (azure-sb-topic-listkeys).
confidence: 0.95
derived_from:
- Microsoft.ServiceBus/namespaces/topics/authorizationRules (existence of active rules)
false_positive_note: Topic-level SAS keys are scoped to that topic only. This edge asserts the topic
STORES SAS credentials at entity scope. Exploitation requires CanReadSecret via topic-level listKeys/action
or embedded credentials.
narrative: Service Bus topic {topic.name} has active SAS authorization rules whose connection strings
grant data-plane access scoped to this topic; these connection strings are credentials readable by
any principal with the topic-level listKeys action.