azure-swa-list-secrets

id: azure-swa-list-secrets
emits: CanReadSecret
description: Retrieve the SWA deployment token (AZURE_STATIC_WEB_APPS_API_TOKEN) via listSecrets/action.
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Web/staticSites/listSecrets/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: APIKey
  source: <principal>
  target: <SWA deployment token (APIKey)>
  permissions:
  - Microsoft.Web/staticSites/listSecrets/action
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal effectively holds listSecrets/action at the SWA resource or a
    parent scope (resource group, subscription) and no deny assignment blocks the action. BLOCKED if a
    deny assignment covers this action.
  confidence: 0.95
  derived_from:
  - Microsoft.Web/staticSites/listSecrets/action effective permission
  false_positive_note: "The deployment token returned by listSecrets is a symmetric secret scoped to this\
    \ SWA only; it does NOT yield ARM credentials or Entra tokens. Website Contributor does NOT include\
    \ listSecrets/action; only Contributor, Owner, or a custom role explicitly granting this action qualifies.\
    \ Verify the effective permission at the specific scope \u2014 a deny assignment at a narrower scope\
    \ blocks even a higher-scope grant."
  narrative: '{principal.name} can call listSecrets/action on Static Web App {target.name} to retrieve
    the deployment token (AZURE_STATIC_WEB_APPS_API_TOKEN), the symmetric secret used by the CI/CD pipeline
    to push content to the site.'