azure-sf-read-client-cert
The cluster admin client certificate stored in Key Vault yields data-plane admin over the cluster.
match (effective permission)
{
"action": "Key Vault secret/certificate get (data-plane or RBAC)",
"scope_type": "resource"
}
where
the KV secret/certificate is the cluster ADMIN client certificate (thumbprint present in cluster fabric settings clientCertificateThumbprints/admin)
emit
| source | <principal> |
|---|---|
| target | <admin client certificate secret> |
| permissions | Microsoft.KeyVault/vaults/secrets/getSecret/action | secret get data action |
Narrative
{principal.name} can read the cluster admin client certificate from Key Vault, obtaining data-plane admin over {cluster.name}.
Raw rule rules/derived/azure/servicefabric.yaml
id: azure-sf-read-client-cert
emits: CanReadSecret
description: The cluster admin client certificate stored in Key Vault yields data-plane admin over the
cluster.
match_effective_permission:
action: Key Vault secret/certificate get (data-plane or RBAC)
scope_type: resource
where:
- the KV secret/certificate is the cluster ADMIN client certificate (thumbprint present in cluster fabric
settings clientCertificateThumbprints/admin)
emit:
source: <principal>
target: <admin client certificate secret>
permissions:
- Microsoft.KeyVault/vaults/secrets/getSecret/action | secret get data action
note: Feeds CredentialsFor(cert -> cluster admin data-plane) and enables azure-sf-admin-client-provision.
false_positive_note: Only escalates if the certificate is an ADMIN client cert (not a user/read-only
client cert, not the server/cluster cert). Confirm the thumbprint maps to the admin client role in
cluster config.
narrative: '{principal.name} can read the cluster admin client certificate from Key Vault, obtaining
data-plane admin over {cluster.name}.'