CanReadSecret
Source can read secret material (often yields creds for another identity/service).
Identity, Compute
── CanReadSecret ──▸
Secret, ConnectionString, Password, APIKey, Certificate, ApplicationPlatform
Source types
IdentityComputeStates
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | both |
|---|---|
| conditions | iam_permission resource_policy key_permission |
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
secretsmanager:GetSecretValue ssm:GetParameter (SecureString)
|
|
| gcp |
secretmanager.versions.access
|
|
| azure |
Key Vault secret get (data-plane / RBAC)
|
Rules that emit CanReadSecret 73
Reading snapshot data (CanReadData) that contains secrets (ContainsSecret) lets the principal extract and authenticate as the identity those secrets belong to - shorthand for the CanReadData → ContainsSecret → CredentialsFor chain into the CanReadSecret pivot. This rule feeds credential-chains.yaml: read-secret-yields-identity.
awsderived
Task execution role reads Secrets Manager / SSM secrets referenced in the task definition.
awsderived
events:RetrieveConnectionCredentials returns the raw OAuth2/API-key credential stored in an EventBridge Connection; anyone with this action can read the credential.
awsderived
Decrypt on a CMK completes the key_permission gate for a secret encrypted under it.
awsderived
awsderived
awsderived
A principal with es:UpdateDomainConfig on a FGAC domain with internal user database can reset and effectively read the master-user password.
awsderived
A principal that can read a bucket's data (CanReadData) and the bucket contains secrets (ContainsSecret) can read those secrets via s3:GetObject.
awsderived
Reading data from a Timestream table that contains secret material yields the ability to read those secrets, enabling credential-chain pivots.
awsderived
App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.
azurederived
App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.
azurederived
snapshots/read returns the key-values frozen in a snapshot, including secret ones.
azurederived
A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.
azurederived
azurederived
azurederived
azurederived
Principal with deployments/read can retrieve sensitive values (listKeys results, Key Vault references) stored in deployment output history.
azurederived
Principal with deploymentScripts/read can retrieve plaintext values from the script's environmentVariables array if credentials are passed inline.
azurederived
Read a plaintext (non-encrypted) Automation Variable directly from ARM; encrypted variables require runbook execution.
azurederived
Read Automation Credentials (username/password pairs) via automationAccounts/credentials/read; values require data-plane getProperties/action or runbook execution.
azurederived
azurederived
azurederived
azurederived
azurederived
READ ACL on a Databricks secret scope allows reading its secrets via dbutils.secrets.get().
azurederived
Read an ADF linked service definition that contains inline connection string, storage key, SP client secret, or password.
azurederived
Read an ADF pipeline definition containing inline SAS URLs, API keys, or connection strings in activity url/body parameters.
azurederived
Obtain a short-lived ADF data-plane access token (getDataPlaneAccess/action) scoped to factory Author/Monitor/DataAccess operations.
azurederived
A pipeline that references a non-Key Vault variable group has the group's secret variables injected into every job's environment; pipeline code can read and log them.
azurederived
A Key Vault-linked variable group exposes Azure Key Vault secrets to pipeline runs; the pipeline's service-connection identity must hold Key Vault Secrets User RBAC.
azurederived
A pipeline stage that uses DownloadSecureFile@1 (or equivalent) materializes the secure file on the agent disk; pipeline code can read the certificate, SSH key, or credential file.
azurederived
Retrieve the topic access key (aeg-sas-key) from an Event Grid custom topic; the key enables unlimited event publishing to the topic, triggering all subscribers.
azurederived
Retrieve the domain access key from an Event Grid domain; the key enables publishing to ALL topics within the domain, triggering all their subscribers.
azurederived
Read SAS signing keys for a namespace-level authorization rule via listkeys/action; the primary and secondary keys can forge SAS tokens for all event hubs in the namespace.
azurederived
Read SAS signing keys for an entity-level (event-hub) authorization rule via listkeys/action; keys are scoped to one event hub.
azurederived
azurederived
azurederived
azurederived
azurederived
azurederived
azurederived
Key Vault Administrator over the vault yields read/decrypt/sign on every object in it.
azurederived
A vault self-grant yields read of every secret/cert in the vault.
azurederived
List the embedded key/token for an API connection used by a Logic App (listConnectionKeys/action).
azurederived
Obtain the SAS-signed HTTP trigger callback URL for a Logic App (listCallbackUrl/action).
azurederived
Read decrypted app settings and connection strings of a Standard Logic App (config/list/Action).
azurederived
Read run-history expression traces containing secrets (API keys, connection strings, tokens) via listExpressionTraces/action.
azurederived
Retrieve stored datastore credentials (storage account key, SAS token, or SP client secret) via listsecrets.
azurederived
Retrieve workspace connection secrets (API keys for OpenAI, Cognitive Services, or custom REST endpoints) via connections/listsecrets.
azurederived
Retrieve the API key for a key-authenticated online endpoint via listkeys/action; required to invoke public endpoints.
azurederived
Retrieve the raw SAS key (primaryKey/secondaryKey/connectionStrings) from a Notification Hub authorization rule via ARM listKeys; the DefaultFullSharedAccessSignature key yields hub-wide Send+Manage data-plane access.
azurederived
Retrieve all PNS credentials (APNS cert/token, FCM API key, WNS packageSid+secret, etc.) from a Notification Hub via ARM pnsCredentials; credentials are reusable outside Azure.
azurederived
listKeys or regenerateKey on an Azure OpenAI account retrieves symmetric API keys that authenticate to all model deployments.
azurederived
Read the primary and secondary connection strings of a namespace-level SAS authorization rule via listKeys; the connection string grants the rule's claims (Send/Listen/Manage) data-plane-wide.
azurederived
Read the connection string of a queue-level SAS authorization rule; scoped to that queue only.
azurederived
Read the connection string of a topic-level SAS authorization rule; scoped to that topic only.
azurederived
The cluster admin client certificate stored in Key Vault yields data-plane admin over the cluster.
azurederived
Retrieve the SWA deployment token (AZURE_STATIC_WEB_APPS_API_TOKEN) via listSecrets/action.
azurederived
integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can register a self-hosted IR node, giving that node persistent pipeline-execution foothold.
azurederived
A principal with read access to a hub VPN connection resource can retrieve the pre-shared key (PSK) in plaintext from the ARM GET response (sharedKey field). The PSK enables establishing a rogue S2S VPN tunnel to the same hub, granting network-layer transit reach to all connected spoke VNets.
azurederived
A principal with read access to ExpressRoute circuit authorizations can retrieve the authorization key in plaintext, enabling a gateway in a DIFFERENT subscription to connect to the same circuit, bridging network topologies and bypassing subscription boundaries.
azurederived
Executing as a workload identity inherits that identity's ability to read a secret.
derived
Holding decrypt on a secret's wrapping key upgrades a key-gated (CONDITIONAL) secret read to ACTIVE.
derived
A CMEK-encrypted Secret Manager secret is readable while the service agent holds useToDecrypt on the key.
gcpderived
secretmanager.versions.access reads the cleartext payload of a secret.
gcpderived
Read a CMEK-encrypted secret; decrypt is done by the Secret Manager service agent, not the caller.
gcpderived
A principal that can execute as a workload SA holding versions.access can read the secret.
gcpderived
awsexplicit
opsworks:DescribeStackProvisioningParameters exposes agent registration keys and other provisioning secrets.
awsexplicit
awsexplicit
awsexplicit
awsexplicit
gcpexplicit
Exposure sites that emit CanReadSecret 14
Kubernetes core/v1 Secret.data / stringData
awscritical
GetSecretValue.SecretString / SecretBinary
awscritical
BatchGetSecretValue.SecretValues[].SecretString / SecretValues[].SecretBinary
awscritical
GetParameter.Parameter.Value
awscritical
GetParameterHistory.Parameters[].Value
awscritical
composer.projects.locations.environments.userWorkloadsSecrets.get.data.<value>
gcpcritical
Kubernetes CoreV1 readNamespacedSecret/listSecretForAllNamespaces.Secret.data.<value>/Secret.stringData.<value>
gcpcritical
secretmanager.projects.secrets.versions.access.payload.data
gcpcritical
Kubernetes core/v1 Secret.{data,stringData}
azurecritical
App Configuration KeyValue.{key,value,content_type,tags}
azurecritical
{vaultUri}/secrets/{name} -> value
azurecritical
Key Vault Secret.value
azurecritical
Key Vault Key decrypt response.result
azurecritical
Managed HSM Key decrypt response.result
azurecritical