azure-storage-blob-data-contributor-write-account-scope

Storage Blob Data Contributor/Owner at account scope grants blob write access to all containers.

derived azure emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ObjectStorage`
source	`?principal`
target	`?account`
permissions	`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
conditions	`iam_permission` `network_reachability`
state logic	if networkAcls.defaultAction == Deny AND caller has no allowed network path or PE: CONDITIONAL(network_reachability); elif deny assignment covers blobs/write at effective scope: BLOCKED; else ACTIVE.

source type

Identity

target type

ObjectStorage

source

?principal

target

?account

permissions

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write

conditions

iam_permission network_reachability

state logic

if networkAcls.defaultAction == Deny AND caller has no allowed network path or PE: CONDITIONAL(network_reachability); elif deny assignment covers blobs/write at effective scope: BLOCKED; else ACTIVE.

Narrative

{principal.name} can write to any blob container in {account.name} (Storage Blob Data Contributor or Owner at account scope), enabling overwrite of config files, scripts, ML artifacts, or pipeline inputs consumed by downstream compute services.

Raw rule rules/derived/azure/storage.yaml

id: azure-storage-blob-data-contributor-write-account-scope
emits: CanWriteData
description: Storage Blob Data Contributor/Owner at account scope grants blob write access to all containers.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Storage and node_type(?account) == ObjectStorage
- node_type(?account) matched provider_type == 'Microsoft.Storage/storageAccounts'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
  at ?account scope (Storage Blob Data Contributor ba92f5b4 or Storage Blob Data Owner b7e6dc6d)
emit:
  source_type: Identity
  target_type: ObjectStorage
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND caller has no allowed network path or PE: CONDITIONAL(network_reachability);
    elif deny assignment covers blobs/write at effective scope: BLOCKED; else ACTIVE.'
  confidence: '0.88'
  derived_from:
  - rule_id: azure-storage-blob-write-permission
    binding: ?principal HasPermission ?account
  false_positive_note: "This rule fires on account-scoped grants only (RBAC assigned at the account node).\
    \ The target is the entire account. CanWriteData alone is not escalation; its attack value is realized\
    \ when blobs are consumed by downstream compute (Functions, Data Factory, Databricks, AML) \u2014\
    \ compute service rules derive CanModifyCode from this. Immutability policies (WORM) block writes\
    \ when container has properties.hasImmutabilityPolicy == true or locked retention policy. Network\
    \ gate applies as with CanReadData. See azure-storage-blob-data-contributor-write-container-scope\
    \ for container-scoped grants."
  narrative: '{principal.name} can write to any blob container in {account.name} (Storage Blob Data Contributor
    or Owner at account scope), enabling overwrite of config files, scripts, ML artifacts, or pipeline
    inputs consumed by downstream compute services.'