AccessKey

A SecureString parameter exposes credential material to any reader.

listKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.

Account key (from listKeys) grants full data-plane read and SAS generation - enabling complete data exfiltration.

An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that credential to principals with listsecrets.

A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.

Shared key -> data-plane task submit on an identity-bearing pool => execute as the pool MI.

listKeys/action returns Cosmos DB master keys, bypassing all data-plane RBAC and network controls.

readonlykeys/action returns Cosmos DB read-only master keys - bypasses data-plane RBAC for read operations across all databases and containers.

A principal holding the domain access key can publish events to ALL topics within the Event Grid domain, triggering all subscribers across the domain.

Retrieve the domain access key from an Event Grid domain; the key enables publishing to ALL topics within the domain, triggering all their subscribers.

Retrieve the topic access key (aeg-sas-key) from an Event Grid custom topic; the key enables unlimited event publishing to the topic, triggering all subscribers.

A principal that holds the topic access key (retrieved via listKeys/action) can publish arbitrary events to the topic over HTTPS, triggering all bound consumers.

ANF account with AD join configured contains the machine account password as an AccessKey.

listCredentials/action permission on ANF account grants CanReadCredential on the AD join AccessKey.

Retrieving the cache access key via listKeys/action yields full data-plane read of all cached data, subject to network reachability of the Redis endpoint.

Retrieving the cache access key via listKeys/action yields full data-plane write of all cached data (SET, DEL, FLUSHDB, CONFIG SET), subject to network reachability of the Redis endpoint.

The Redis access keys are exposed via the cache resource whenever a principal with listKeys/action can retrieve them. This is a structural credential-exposure edge: the cache itself exposes the keys as a resource-level property, coupled with a principal's CanReadCredential permission.

A principal with listKeys/action permission can retrieve the Redis access key via ARM, gaining read access to the credential.

generateUserDelegationKey/action returns user-delegation key material (not a pre-formed SAS token) - the caller can sign arbitrary user-delegation SAS URLs offline within the key's validity window.

listKeys/action returns storage account keys, bypassing all Azure RBAC and network controls for all sub-services (when SharedKey auth is enabled).