ConnectionString

events:RetrieveConnectionCredentials returns the raw OAuth2/API-key credential stored in an EventBridge Connection; anyone with this action can read the credential.

An EventBridge Connection with API_KEY, OAUTH_CLIENT_CREDENTIALS, or BASIC auth contains a stored credential used to authenticate API destination calls.

A Glue Connection stores JDBC/Kafka/OAuth credentials; glue:GetConnection returns the plaintext PASSWORD, exposing the database credential.

A SecureString parameter exposes credential material to any reader.

An ADF linked service stores a long-lived embedded credential (connection string, storage key, SP secret) exposed to pipeline runs.

An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that credential to principals with listsecrets.

A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.

App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.

App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.

A principal with listKeys/action obtains the store's access-key connection strings (unless local auth is disabled).

snapshots/read returns the key-values frozen in a snapshot, including secret ones.

listConnectionStrings/action returns connection strings embedding the Cosmos DB master keys - equivalent credential exposure to listKeys.

An API connection stores a long-lived service credential (key/token) usable by any code that can call listConnectionKeys.

Retrieve the raw SAS key (primaryKey/secondaryKey/connectionStrings) from a Notification Hub authorization rule via ARM listKeys; the DefaultFullSharedAccessSignature key yields hub-wide Send+Manage data-plane access.

A Service Bus namespace with readable SAS keys exposes its connection-string credential to any principal with listKeys access.

Read the primary and secondary connection strings of a namespace-level SAS authorization rule via listKeys; the connection string grants the rule's claims (Send/Listen/Manage) data-plane-wide.

A Service Bus namespace with active SAS authorization rules embeds connection-string credentials usable at data-plane without Entra RBAC.

Read the connection string of a queue-level SAS authorization rule; scoped to that queue only.

A Service Bus queue with active entity-level SAS authorization rules embeds queue-scoped connection-string credentials usable at data-plane without Entra RBAC.

Holding a SAS connection string with Listen rights grants data-plane receive from the scoped queue/subscription - messages may carry secrets.

Holding a SAS connection string with Send rights (obtained via CanReadSecret/listKeys) grants data-plane send to the scoped namespace/queue/topic - equivalent to the Entra Data Sender role but credential-based.

Read the connection string of a topic-level SAS authorization rule; scoped to that topic only.

A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped connection-string credentials usable at data-plane without Entra RBAC.

A Synapse linked service that stores credentials as plaintext (SQL auth password, storage key, SAS token) exposes those credentials to any principal with Synapse Linked Data Manager or Synapse Administrator role.

Datastream ConnectionProfile resources store source DB credentials (username/password or SSH private key). An attacker with write access (connectionProfiles.create/update) can harvest credentials by redirecting a test connection to a controlled host; secretManagerStoredPassword references expose Secret Manager paths.