azure-storage-table-data-reader

Storage Table Data Reader grants table entity read - table data may contain application credentials or sensitive configuration.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`NoSQLDatabase`
source	`?principal`
target	`?table`
permissions	`Microsoft.Storage/storageAccounts/tableServices/tables/entities/read`
conditions	`iam_permission` `network_reachability`
state logic	if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability); elif deny assignment covers entities/read at scope: BLOCKED; else ACTIVE.

source type

Identity

target type

NoSQLDatabase

source

?principal

target

?table

permissions

Microsoft.Storage/storageAccounts/tableServices/tables/entities/read

conditions

iam_permission network_reachability

state logic

if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability); elif deny assignment covers entities/read at scope: BLOCKED; else ACTIVE.

Narrative

{principal.name} can read entity data from table {table.name} (Storage Table Data Reader or Contributor). Table rows may contain application credentials or configuration used for lateral movement.

Raw rule rules/derived/azure/storage.yaml

id: azure-storage-table-data-reader
emits: CanReadData
description: "Storage Table Data Reader grants table entity read \u2014 table data may contain application\
  \ credentials or sensitive configuration."
match:
- - principal: null
  - HasPermission
  - table: null
where:
- node_class(?table) == Data and node_type(?table) == NoSQLDatabase
- node_type(?table) matched provider_type == 'Microsoft.Storage/storageAccounts/tableServices/tables'
- ?principal has EFFECTIVE dataAction Microsoft.Storage/storageAccounts/tableServices/tables/entities/read
  at ?table scope (Storage Table Data Reader 76199698 or Storage Table Data Contributor 0a9a7e1f)
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: ?principal
  target: ?table
  permissions:
  - Microsoft.Storage/storageAccounts/tableServices/tables/entities/read
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND no allowed path or PE: CONDITIONAL(network_reachability);
    elif deny assignment covers entities/read at scope: BLOCKED; else ACTIVE.'
  confidence: '0.82'
  derived_from:
  - rule_id: azure-storage-table-read-permission
    binding: ?principal HasPermission ?table
  false_positive_note: "Lower base confidence than blob read \u2014 table data is less frequently the\
    \ direct source of credential pivots, but applications do store configuration and auth tokens in table\
    \ storage. Apply ContainsSecret/ContainsCredential on the table node when evidence indicates credential\
    \ storage; credential-chains then handles the escalation. Network gate applies identically to blob/queue."
  narrative: '{principal.name} can read entity data from table {table.name} (Storage Table Data Reader
    or Contributor). Table rows may contain application credentials or configuration used for lateral
    movement.'