azure-storage-queue-data-reader

Storage Queue Data Reader/Message Processor grants queue message read - messages may carry SAS tokens, connection strings, or other credentials.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Queue`
source	`?principal`
target	`?queue`
permissions	`Microsoft.Storage/storageAccounts/queueServices/queues/messages/read`
conditions	`iam_permission` `network_reachability`
state logic	if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability); elif deny assignment covers messages/read at effective scope: BLOCKED; else ACTIVE.

source type

Identity

target type

Queue

source

?principal

target

?queue

permissions

Microsoft.Storage/storageAccounts/queueServices/queues/messages/read

conditions

iam_permission network_reachability

state logic

if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability); elif deny assignment covers messages/read at effective scope: BLOCKED; else ACTIVE.

Narrative

{principal.name} can read messages from queue {queue.name} (Storage Queue Data Reader or equivalent), which may contain SAS tokens, connection strings, or other credential material. See credential-chains.yaml for ContainsSecret -> CredentialsFor -> CanImpersonate roll-up when messages carry credentials.

Raw rule rules/derived/azure/storage.yaml

id: azure-storage-queue-data-reader
emits: CanReadData
description: "Storage Queue Data Reader/Message Processor grants queue message read \u2014 messages may\
  \ carry SAS tokens, connection strings, or other credentials."
match:
- - principal: null
  - HasPermission
  - queue: null
where:
- node_class(?queue) == Messaging and node_type(?queue) == Queue
- node_type(?queue) matched provider_type == 'Microsoft.Storage/storageAccounts/queueServices/queues'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/queueServices/queues/messages/read
  at ?queue scope (Storage Queue Data Reader 19e7f393, Storage Queue Data Contributor 974c5e8b, or Storage
  Queue Data Message Processor 8a0f0c08)
emit:
  source_type: Identity
  target_type: Queue
  source: ?principal
  target: ?queue
  permissions:
  - Microsoft.Storage/storageAccounts/queueServices/queues/messages/read
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability);
    elif deny assignment covers messages/read at effective scope: BLOCKED; else ACTIVE.'
  confidence: '0.85'
  derived_from:
  - rule_id: azure-storage-queue-read-permission
    binding: ?principal HasPermission ?queue
  false_positive_note: "Queue data access is a data-plane action gated by networkAcls. The attack value\
    \ is elevated when queue messages carry SAS tokens, temporary credentials, or job payloads with embedded\
    \ connection strings \u2014 ContainsSecret/ContainsCredential on the queue node drives the credential-chains\
    \ roll-up. Do not confuse the account-level queue service RBAC scope with blob RBAC \u2014 separate\
    \ role assignments. Network gate applies."
  narrative: '{principal.name} can read messages from queue {queue.name} (Storage Queue Data Reader or
    equivalent), which may contain SAS tokens, connection strings, or other credential material. See credential-chains.yaml
    for ContainsSecret -> CredentialsFor -> CanImpersonate roll-up when messages carry credentials.'