rage.fail

Password

Password credential.

class: Secret derivation-only - no collection recipe

Realizing resources

This type has no collection recipe - it appears only as the endpoint of derived edges.

As edge source

ContainsCredentialValidForCredentialsForExposedToAccountExposedToTenantExposesCredentialHasPolicyLocatedIn

As edge target

AuthenticatesToCanAdministerCanControlCanCreateCanDeleteCanModifyCanModifyConfigurationCanModifyPolicyCanReadCanReadSecretCanReplaceCanTakeOwnershipCanWriteContainsContainsResourceReferenceContainsSecretControlsExposesCredentialHasPermission

Exposure sites

200+ sites reference this type

Rules that touch Password 6

aws-ssm-params-exposes-credential
A SecureString parameter exposes credential material to any reader.
aws ExposesCredential
azure-appconfig-connstring-reads-all-kv
A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.
azure CanReadSecret
azure-appconfig-data-owner-read-kv
App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.
azure CanReadSecret
azure-appconfig-data-reader-read-kv
App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.
azure CanReadSecret
azure-appconfig-snapshot-read-kv
snapshots/read returns the key-values frozen in a snapshot, including secret ones.
azure CanReadSecret
azure-msgraph-user-password-reset
A service principal holding User.ReadWrite.All (or Directory.ReadWrite.All) can reset any non-protected Entra user's password via PATCH /users/{id} with a new passwordProfile, taking over that user's account and inheriting their RBAC and group memberships.
azure CanResetCredential
↑↓ move · ↵ open · esc close