Derivation rules

A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.

App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.

App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.

A principal with listKeys/action obtains the store's access-key connection strings (unless local auth is disabled).

snapshots/read returns the key-values frozen in a snapshot, including secret ones.

Principal with deployments/read can retrieve sensitive values (listKeys results, Key Vault references) stored in deployment output history.

Principal with deploymentScripts/read can retrieve plaintext values from the script's environmentVariables array if credentials are passed inline.

Read Automation Credentials (username/password pairs) via automationAccounts/credentials/read; values require data-plane getProperties/action or runbook execution.

Read a plaintext (non-encrypted) Automation Variable directly from ARM; encrypted variables require runbook execution.

The search service exposes its primary and secondary admin API keys (discoverable via listAdminKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Admin keys grant full data-plane control of the search service (all indexes, indexers, data sources, and queries).

The search service exposes one or more query API keys (discoverable via listQueryKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Query keys grant read-only data-plane access (search, suggest, autocomplete queries against all indexes).

A principal that can obtain an admin or query key (via ExposesCredential) can issue search, suggest, and autocomplete queries against all indexes in the service, reading the full content of matching indexed documents.

A Key Vault-linked variable group exposes Azure Key Vault secrets to pipeline runs; the pipeline's service-connection identity must hold Key Vault Secrets User RBAC.

A pipeline stage that uses DownloadSecureFile@1 (or equivalent) materializes the secure file on the agent disk; pipeline code can read the certificate, SSH key, or credential file.

A pipeline that references a non-Key Vault variable group has the group's secret variables injected into every job's environment; pipeline code can read and log them.

An OS-type managed disk (Windows or Linux) is heuristically classified as containing credential material: SAM/NTDS hive, /etc/shadow, SSH private keys, or application credential files.

A disk that can be SAS-exported and contains secrets exposes those credentials as accessible to external parties. The state (ACTIVE vs CONDITIONAL) depends on the CanExfiltrate edge state.

Key Vault Administrator over the vault yields read/decrypt/sign on every object in it.

A vault self-grant yields read of every secret/cert in the vault.

Read run-history expression traces containing secrets (API keys, connection strings, tokens) via listExpressionTraces/action.

A wrapped store whose wrapping key the principal can decrypt exposes the credential it holds.

A snapshot of an OS-type disk inherits the OS-disk ContainsSecret classification when the source disk is identified.

integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can register a self-hosted IR node, giving that node persistent pipeline-execution foothold.

A principal with read access to ExpressRoute circuit authorizations can retrieve the authorization key in plaintext, enabling a gateway in a DIFFERENT subscription to connect to the same circuit, bridging network topologies and bypassing subscription boundaries.

A principal with read access to a hub VPN connection resource can retrieve the pre-shared key (PSK) in plaintext from the ARM GET response (sharedKey field). The PSK enables establishing a rogue S2S VPN tunnel to the same hub, granting network-layer transit reach to all connected spoke VNets.

Holding decrypt on a secret's wrapping key upgrades a key-gated (CONDITIONAL) secret read to ACTIVE.

A BigQuery Connection resource stores or proxies credentials to an external data source (Cloud SQL, JDBC, Spark); a principal with bigquery.connections.use gains effective access to that external system.

A Cloud Scheduler job's HTTP body (httpTarget.body) or Pub/Sub payload (pubsubTarget.data) may embed credentials. Any principal with cloudscheduler.jobs.get / fullView can read the job definition and recover the embedded credential.

A Cloud SQL instance may store application secrets (API keys, SA keys, connection strings, tokens) in its databases based on schema/table metadata heuristics.

Datastream ConnectionProfile resources store source DB credentials (username/password or SSH private key). An attacker with write access (connectionProfiles.create/update) can harvest credentials by redirecting a test connection to a controlled host; secretManagerStoredPassword references expose Secret Manager paths.

A Firestore database contains collections or document field names whose names indicate credential material (API keys, SA keys, OAuth tokens, database passwords).

Function env vars / mounted Secret Manager bindings carry connection strings / API keys.

A CMEK-encrypted Secret Manager payload authenticates as another identity, completing CanExecuteAs -> CanReadSecret -> CredentialsFor.

A principal that can execute as a workload SA holding versions.access can read the secret.

A Cloud Tasks task body (httpRequest.body, base64-encoded) contains credential material (API keys, passwords, SA key JSON, connection strings) readable by any principal with cloudtasks.tasks.fullView on the queue.

A workflow execution's argument payload may carry secrets passed by the caller; visible in execution metadata to anyone with executions.get.