CanReadCredential

redshift:GetClusterCredentials generates a temporary database username/password, enabling JDBC/ODBC authentication to the cluster as the requested DB user.

registries/listCredentials/action allows a principal to retrieve the admin account's long-lived passwords.

tokens/listPasswords/action returns long-lived passwords for a repository-scoped token - principal can retrieve static credential valid for the actions in the token's scope map.

listKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.

generateUserDelegationKey/action allows minting user-delegation SAS tokens (Token credential type) for external distribution.

listClusterAdminCredential returns a static cluster-admin kubeconfig that bypasses AAD, giving unconditional cluster-admin access to the cluster.

listClusterUserCredential returns a user-level kubeconfig (AAD-token-gated, lower privilege), providing authenticated access to the cluster API server.

Retrieve authentication keys for linked services via listAuthKeys/action, directly accessing the plaintext credential without parsing typeProperties.

listCredentials/action permission on ANF account grants CanReadCredential on the AD join AccessKey.

A principal with listKeys/action permission can retrieve the Redis access key via ARM, gaining read access to the credential.

listKeys/action returns storage account keys, bypassing all Azure RBAC and network controls for all sub-services (when SharedKey auth is enabled).

listAccountSas/action generates a pre-formed account-level SAS token, providing scoped but key-equivalent data-plane access.

generateUserDelegationKey/action returns user-delegation key material (not a pre-formed SAS token) - the caller can sign arbitrary user-delegation SAS URLs offline within the key's validity window.

cloudsql.sslCerts.create returns a client SSL certificate private key (one-time, in the API response), which serves as a database authentication credential.

cloudfunctions.functions.sourceCodeGet returns the deployed source archive, which may embed hardcoded credentials.

cloudsql.sslCerts.create returns a client SSL certificate private key (one-time in the API response), which serves as a database authentication credential.

batch.projects.locations.jobs.get.taskGroups[].taskSpec.runnables[].container.password

cloudbuild.projects.locations.bitbucketServerConfigs.get.apiKey

Apache Airflow REST API / metadata database.Connection passwords/extras and Variable values

eventarc.projects.locations.channels.get.activationToken

container.projects.zones.clusters.get.masterAuth.{username,password,clientCertificate,clientKey}

iap.projects.brands.identityAwareProxyClients.get.secret

redis.projects.locations.instances.getAuthString.authString

redis.projects.locations.clusters.tokenAuthUsers.authTokens.get.token

redis.projects.locations.aclPolicies.get.rules[].{username,rule}

monitoring.projects.uptimeCheckConfigs.get.httpCheck.authInfo.{username,password}

networkconnectivity.projects.locations.serviceConnectionTokens.get.token

networkconnectivity.projects.locations.serviceConnectionMaps.get.token

aiplatform.projects.locations.ragCorpora.get.vectorDbConfig.apiAuth.apiKeyConfig.apiKeyString

compute.vpnTunnels.get.sharedSecret

compute.publicAdvertisedPrefixes.get.sharedSecret

Microsoft.Automation/automationAccounts/credentials get response.properties.{userName,password}

Azure DevOps service endpoint.authorization.parameters.*

Azure Pipelines secure file bytes

Key Vault certificate backing Secret.value

Microsoft.MachineLearningServices/workspaces/datastores/listSecrets response.{secrets,credentials}

Microsoft.MachineLearningServices/workspaces/connections/listSecrets response.credentials

Microsoft.NotificationHubs/namespaces/notificationHubs/pnsCredentials response.properties.{apnsCredential,gcmCredential,admCredential,baiduCredential,wnsCredential}