azure-storage-listaccountsas-exposes-token

listAccountSas/action generates a pre-formed account-level SAS token, providing scoped but key-equivalent data-plane access.

derived azure emits CanReadCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Token`
source	`?principal`
target	`<SAS Token node derived from ?account>`
permissions	`Microsoft.Storage/storageAccounts/listAccountSas/action`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy covers listAccountSas/action: BLOCKED; else ACTIVE. ARM-plane call — not gated by storage network firewall. Treat as ACTIVE with slightly lower confidence than listKeys because the SAS scope depends on the caller-provided parameters (could be narrowed at call time); model as full-account capability for worst-case analysis.

source type

Identity

target type

Token

source

?principal

target

<SAS Token node derived from ?account>

permissions

Microsoft.Storage/storageAccounts/listAccountSas/action

conditions

iam_permission

state logic

if a deny assignment or deny Azure Policy covers listAccountSas/action: BLOCKED; else ACTIVE. ARM-plane call — not gated by storage network firewall. Treat as ACTIVE with slightly lower confidence than listKeys because the SAS scope depends on the caller-provided parameters (could be narrowed at call time); model as full-account capability for worst-case analysis.

Narrative

{principal.name} can call listAccountSas on {account.name} (Microsoft.Storage/storageAccounts/listAccountSas/action), generating a pre-formed account-level SAS token. The token can grant access to any or all storage sub-services at account scope - equivalent to a time-limited account key.

Raw rule rules/derived/azure/storage.yaml

id: azure-storage-listaccountsas-exposes-token
emits: CanReadCredential
description: listAccountSas/action generates a pre-formed account-level SAS token, providing scoped but
  key-equivalent data-plane access.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Storage and node_type(?account) == ObjectStorage
- node_type(?account) matched provider_type == 'Microsoft.Storage/storageAccounts'
- ?principal has EFFECTIVE Microsoft.Storage/storageAccounts/listAccountSas/action at ?account scope
emit:
  source_type: Identity
  target_type: Token
  source: ?principal
  target: <SAS Token node derived from ?account>
  permissions:
  - Microsoft.Storage/storageAccounts/listAccountSas/action
  conditions:
  - iam_permission
  state_logic: "if a deny assignment or deny Azure Policy covers listAccountSas/action: BLOCKED; else\
    \ ACTIVE. ARM-plane call \u2014 not gated by storage network firewall. Treat as ACTIVE with slightly\
    \ lower confidence than listKeys because the SAS scope depends on the caller-provided parameters (could\
    \ be narrowed at call time); model as full-account capability for worst-case analysis."
  confidence: '0.90'
  derived_from:
  - rule_id: azure-storage-listaccountsas-permission
    binding: ?principal HasPermission ?account
  false_positive_note: "listAccountSas is an ARM-plane call, not gated by networkAcls. The generated SAS\
    \ token's scope depends on the parameters supplied by the caller \u2014 it can be narrowed at call\
    \ time but worst-case covers all services. Model as ExposesCredential -> Token. Do not conflate with\
    \ user-delegation SAS (generateUserDelegationKey) which is bounded by the caller's Entra effective\
    \ permissions. listAccountSas callers: Contributor, Owner, and custom roles explicitly granting listAccountSas/action.\
    \ Storage Account Key Operator Service Role (81a9662b) includes listKeys and regenerateKey only, NOT\
    \ listAccountSas. Verify against current Microsoft.Storage role definitions."
  narrative: "{principal.name} can call listAccountSas on {account.name} (Microsoft.Storage/storageAccounts/listAccountSas/action),\
    \ generating a pre-formed account-level SAS token. The token can grant access to any or all storage\
    \ sub-services at account scope \u2014 equivalent to a time-limited account key."