azure-snapshot-pmk-read-active

An attacker who can SAS-export a PMK-encrypted or unencrypted snapshot can read the plaintext data immediately upon download (no key gate).

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Snapshot`
source	`?principal`
target	`?snapshot`
permissions	`Microsoft.Compute/snapshots/beginGetAccess/action`
state logic	ACTIVE: Platform-managed key (PMK) or unencrypted snapshots require no additional decrypt gate. Azure's platform transparently decrypts the data upon download. The CanExfiltrate edge is the only requirement; plaintext readability is immediate.

source type

Identity

target type

Snapshot

source

?principal

target

?snapshot

permissions

Microsoft.Compute/snapshots/beginGetAccess/action

state logic

ACTIVE: Platform-managed key (PMK) or unencrypted snapshots require no additional decrypt gate. Azure's platform transparently decrypts the data upon download. The CanExfiltrate edge is the only requirement; plaintext readability is immediate.

Narrative

{principal.name} can download snapshot {target.name} via SAS and read the plaintext data immediately. The snapshot uses platform-managed encryption (PMK), so Azure decrypts transparently without requiring customer key access.

Raw rule rules/derived/azure/disks.yaml

id: azure-snapshot-pmk-read-active
emits: CanReadData
description: An attacker who can SAS-export a PMK-encrypted or unencrypted snapshot can read the plaintext
  data immediately upon download (no key gate).
match:
- - principal: null
  - CanExfiltrate
  - snapshot: null
where:
- node_type(?snapshot) == Snapshot
- ?snapshot.encryption.type in [EncryptionAtRestWithPlatformKey, null/unset]
emit:
  source_type: Identity
  target_type: Snapshot
  source: ?principal
  target: ?snapshot
  permissions:
  - Microsoft.Compute/snapshots/beginGetAccess/action
  conditions: []
  state_logic: 'ACTIVE: Platform-managed key (PMK) or unencrypted snapshots require no additional decrypt
    gate. Azure''s platform transparently decrypts the data upon download. The CanExfiltrate edge is the
    only requirement; plaintext readability is immediate.'
  confidence: 0.95
  derived_from:
  - <CanExfiltrate edge_id for ?snapshot>
  false_positive_note: Applies ONLY to snapshots with encryption.type in [EncryptionAtRestWithPlatformKey,
    null/unset]. Do NOT emit for CMK-encrypted snapshots (use azure-snapshot-cmk-gated-read instead).
  narrative: '{principal.name} can download snapshot {target.name} via SAS and read the plaintext data
    immediately. The snapshot uses platform-managed encryption (PMK), so Azure decrypts transparently
    without requiring customer key access.'