azure-snapshot-sas-export-active
beginGetAccess/action on a snapshot with AllowAll (default) network access policy mints an internet-routable anonymous SAS download URL.
match (effective permission)
{
"action": "Microsoft.Compute/snapshots/beginGetAccess/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
snapshot.networkAccessPolicy in [AllowAll, null/unset]
snapshot.publicNetworkAccess != Disabled
emit
| source type | Identity |
|---|---|
| target type | Snapshot |
| source | <principal> |
| target | <disk snapshot> |
| permissions | Microsoft.Compute/snapshots/beginGetAccess/action |
| state logic | ACTIVE: SAS URL is internet-routable for the SAS duration when snapshot.networkAccessPolicy is AllowAll/unset and publicNetworkAccess is not Disabled. |
Narrative
{principal.name} can mint a SAS download URL for snapshot {target.name} (snapshots/beginGetAccess/action, default AllowAll policy) and download the point-in-time disk image to any external storage account or local machine.
Raw rule rules/derived/azure/disks.yaml
id: azure-snapshot-sas-export-active
emits: CanExfiltrate
description: beginGetAccess/action on a snapshot with AllowAll (default) network access policy mints an
internet-routable anonymous SAS download URL.
match_effective_permission:
action: Microsoft.Compute/snapshots/beginGetAccess/action
scope_type: resource|resourceGroup|subscription
where:
- snapshot.networkAccessPolicy in [AllowAll, null/unset]
- snapshot.publicNetworkAccess != Disabled
emit:
source_type: Identity
target_type: Snapshot
source: <principal>
target: <disk snapshot>
permissions:
- Microsoft.Compute/snapshots/beginGetAccess/action
conditions: []
state_logic: 'ACTIVE: SAS URL is internet-routable for the SAS duration when snapshot.networkAccessPolicy
is AllowAll/unset and publicNetworkAccess is not Disabled.'
confidence: 0.95
derived_from:
- HasPermission(principal, Microsoft.Compute/snapshots/beginGetAccess/action, snapshot)
false_positive_note: This rule applies only when networkAccessPolicy is AllowAll/unset (default) AND
publicNetworkAccess is not explicitly Disabled. Honor deny assignments on the snapshot RG.
narrative: '{principal.name} can mint a SAS download URL for snapshot {target.name} (snapshots/beginGetAccess/action,
default AllowAll policy) and download the point-in-time disk image to any external storage account
or local machine.'