rage.fail

azure-storage-account-contains-keys

explicit azure emits ContainsCredential

match (record)

{ "field": "properties.primaryEndpoints", "resource_type": "Microsoft.Storage/storageAccounts" }

emit

source type	`ObjectStorage`
target type	`AccessKey`
source	`<storageAccount node>`
target	`<primary AccessKey node> and <secondary AccessKey node>`

Narrative

{account.name} holds primary and secondary account access keys structurally. When allowSharedKeyAccess=true or unset (default), these keys bypass all Azure RBAC and network controls when used. When allowSharedKeyAccess=false, the keys are present but the storage service rejects SharedKey authentication attempts.

Raw rule rules/explicit/azure-storage.yaml

id: azure-storage-account-contains-keys
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.Storage/storageAccounts
  field: properties.primaryEndpoints
emit:
  source_type: ObjectStorage
  target_type: AccessKey
  source: <storageAccount node>
  target: <primary AccessKey node> and <secondary AccessKey node>
  api_source: Microsoft.Storage/storageAccounts GET
  evidence_field: properties.primaryEndpoints
  narrative: '{account.name} holds primary and secondary account access keys structurally. When allowSharedKeyAccess=true
    or unset (default), these keys bypass all Azure RBAC and network controls when used. When allowSharedKeyAccess=false,
    the keys are present but the storage service rejects SharedKey authentication attempts.'