azure-storage-blob-data-reader-account-scope

Storage Blob Data Reader/Contributor/Owner at account scope grants data-plane read of all blob containers.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'account': None}

where

node_class(?account) == Storage and node_type(?account) == ObjectStorage node_type(?account) matched provider_type == 'Microsoft.Storage/storageAccounts' ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read at ?account scope (Storage Blob Data Reader 2a2b9908, Storage Blob Data Contributor ba92f5b4, or Storage Blob Data Owner b7e6dc6d)

emit

source type	`Identity`
target type	`ObjectStorage`
source	`?principal`
target	`?account`
permissions	`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
conditions	`iam_permission` `network_reachability`
state logic	if networkAcls.defaultAction == Deny AND ?principal NOT in IP/VNet allowlist AND no private endpoint path from ?principal to ?account: CONDITIONAL(network_reachability); elif a deny assignment or deny Azure Policy covers blobs/read at effective scope: BLOCKED; else ACTIVE. For HNS accounts where ?principal holds Storage Blob Data Owner (runAsSuperUser), note ACL bypass in narrative but state remains ACTIVE. For Storage Blob Data Reader/Contributor on HNS accounts, POSIX ACLs may narrow access at specific paths — model as ACTIVE at RBAC level; ACL-based path restrictions are runtime enforcement the graph cannot enumerate per-object.

Narrative

{principal.name} holds the blobs/read dataAction on {account.name} at the account scope (Storage Blob Data Reader or higher), enabling data-plane read of blob content in all containers within the account. Blobs may contain embedded credentials, connection strings, or secrets - see credential-chains.yaml for ContainsSecret -> CredentialsFor -> CanImpersonate roll-up.

Raw rule rules/derived/azure/storage.yaml

id: azure-storage-blob-data-reader-account-scope
emits: CanReadData
description: Storage Blob Data Reader/Contributor/Owner at account scope grants data-plane read of all
  blob containers.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Storage and node_type(?account) == ObjectStorage
- node_type(?account) matched provider_type == 'Microsoft.Storage/storageAccounts'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
  at ?account scope (Storage Blob Data Reader 2a2b9908, Storage Blob Data Contributor ba92f5b4, or Storage
  Blob Data Owner b7e6dc6d)
emit:
  source_type: Identity
  target_type: ObjectStorage
  source: ?principal
  target: ?account
  permissions:
  - Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "if networkAcls.defaultAction == Deny AND ?principal NOT in IP/VNet allowlist AND no private\
    \ endpoint path from ?principal to ?account: CONDITIONAL(network_reachability); elif a deny assignment\
    \ or deny Azure Policy covers blobs/read at effective scope: BLOCKED; else ACTIVE. For HNS accounts\
    \ where ?principal holds Storage Blob Data Owner (runAsSuperUser), note ACL bypass in narrative but\
    \ state remains ACTIVE. For Storage Blob Data Reader/Contributor on HNS accounts, POSIX ACLs may narrow\
    \ access at specific paths \u2014 model as ACTIVE at RBAC level; ACL-based path restrictions are runtime\
    \ enforcement the graph cannot enumerate per-object."
  confidence: '0.90'
  derived_from:
  - rule_id: azure-storage-blob-read-permission
    binding: ?principal HasPermission ?account
  false_positive_note: "This is a data-plane action gated by networkAcls \u2014 apply CONDITIONAL(network_reachability)\
    \ when the storage firewall is on and the caller has no allowed network path or private endpoint.\
    \ Do NOT apply a network condition to listKeys rules (ARM plane). Storage Blob Data Reader does NOT\
    \ grant listKeys or generateUserDelegationKey \u2014 separate actions. For ADLS Gen2 (HNS) accounts\
    \ with POSIX ACLs: RBAC grants the read at ARM level; per-directory ACL denials are runtime enforcement.\
    \ Only Storage Blob Data Owner (runAsSuperUser) bypasses ACLs entirely; annotate accordingly. This\
    \ rule fires on account-scoped grants; see azure-storage-blob-data-reader-container-scope for container-scoped\
    \ grants."
  narrative: "{principal.name} holds the blobs/read dataAction on {account.name} at the account scope\
    \ (Storage Blob Data Reader or higher), enabling data-plane read of blob content in all containers\
    \ within the account. Blobs may contain embedded credentials, connection strings, or secrets \u2014\
    \ see credential-chains.yaml for ContainsSecret -> CredentialsFor -> CanImpersonate roll-up."