azure-snapshot-sas-export-conditional
beginGetAccess/action on a snapshot with AllowPrivate network access policy or publicNetworkAccess: Disabled mints a SAS URL accessible only via private endpoint.
match (effective permission)
{
"action": "Microsoft.Compute/snapshots/beginGetAccess/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
snapshot.networkAccessPolicy == AllowPrivate OR snapshot.publicNetworkAccess == Disabled
emit
| source type | Identity |
|---|---|
| target type | Snapshot |
| source | <principal> |
| target | <disk snapshot> |
| permissions | Microsoft.Compute/snapshots/beginGetAccess/action |
| conditions | network_reachability |
| state logic | CONDITIONAL(network_reachability): SAS URL is scoped to private endpoint or public access is disabled; attacker needs VNet connectivity to fetch the URL. |
Narrative
{principal.name} can mint a SAS download URL for snapshot {target.name} (snapshots/beginGetAccess/action, AllowPrivate or public access disabled); exfiltration requires network connectivity to the private endpoint's VNet.
Raw rule rules/derived/azure/disks.yaml
id: azure-snapshot-sas-export-conditional
emits: CanExfiltrate
description: 'beginGetAccess/action on a snapshot with AllowPrivate network access policy or publicNetworkAccess:
Disabled mints a SAS URL accessible only via private endpoint.'
match_effective_permission:
action: Microsoft.Compute/snapshots/beginGetAccess/action
scope_type: resource|resourceGroup|subscription
where:
- snapshot.networkAccessPolicy == AllowPrivate OR snapshot.publicNetworkAccess == Disabled
emit:
source_type: Identity
target_type: Snapshot
source: <principal>
target: <disk snapshot>
permissions:
- Microsoft.Compute/snapshots/beginGetAccess/action
conditions:
- network_reachability
state_logic: 'CONDITIONAL(network_reachability): SAS URL is scoped to private endpoint or public access
is disabled; attacker needs VNet connectivity to fetch the URL.'
confidence: 0.95
derived_from:
- HasPermission(principal, Microsoft.Compute/snapshots/beginGetAccess/action, snapshot)
false_positive_note: Applies when networkAccessPolicy is AllowPrivate OR publicNetworkAccess is Disabled.
Emit CONDITIONAL(network_reachability) unless attacker foothold in the VNet is confirmed.
narrative: '{principal.name} can mint a SAS download URL for snapshot {target.name} (snapshots/beginGetAccess/action,
AllowPrivate or public access disabled); exfiltration requires network connectivity to the private
endpoint''s VNet.'