azure-storage-blob-data-reader-container-scope

id: azure-storage-blob-data-reader-container-scope
emits: CanReadData
description: Storage Blob Data Reader/Contributor/Owner at container scope grants data-plane read of a
  specific blob container.
match:
- - principal: null
  - HasPermission
  - container: null
where:
- node_class(?container) == Storage and node_type(?container) == ObjectStorage
- node_type(?container) matched provider_type == 'Microsoft.Storage/storageAccounts/blobServices/containers'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
  at ?container scope (Storage Blob Data Reader 2a2b9908, Storage Blob Data Contributor ba92f5b4, or Storage
  Blob Data Owner b7e6dc6d)
emit:
  source_type: Identity
  target_type: ObjectStorage
  source: ?principal
  target: ?container
  permissions:
  - Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability);
    elif deny assignment covers blobs/read at effective scope: BLOCKED; else ACTIVE.'
  confidence: '0.90'
  derived_from:
  - rule_id: azure-storage-blob-read-permission
    binding: ?principal HasPermission ?container
  false_positive_note: This rule fires on container-scoped grants (RBAC assigned at the container node,
    not the account). The target is the specific container, not the account. Network gate applies identically.
    For container-level ACL restrictions in HNS accounts, model as ACTIVE at RBAC level; ACL-based denials
    are runtime enforcement.
  narrative: '{principal.name} holds the blobs/read dataAction on {container.name} (Storage Blob Data
    Reader or higher), enabling data-plane read of blob content in this specific container. Blobs may
    contain embedded credentials or secrets; see credential-chains.yaml for escalation paths.'