brief

# Lab: `azure_imds_keyvault_harvest`

fintech / enterprise / `azure-payment-gateway` · prod

## Your job

An App Service has a managed identity. Can it reach secrets or customer data that a human operator would not expect it to hold?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n07_8b32/sub-corp-prod`: **AzureSubscription** sub-corp-prod-8b32
- `n17_8b32/rg-workloads`: **AzureResourceGroup** rg-workloads-8b32
- `n40_8b32/app-service-frontend`: **AzureAppService** app-service-frontend-8b32
- `n04_8b32/id-app-service-frontend`: **AzureManagedIdentity** id-app-service-frontend-8b32
- `n37_8b32/kv-corp-secrets`: **AzureKeyVault** kv-corp-secrets-8b32
- `n06_8b32/cnt-customer-financials`: **AzureStorageContainer** cnt-customer-financials-8b32
- `n09_8b32/customer-financials`: **DataSet** customer-financials-8b32
- `n33_8b32/id-cache-warmer`: **AzureManagedIdentity** id-cache-warmer-8b32
- `n35_8b32/id-ingest-worker`: **AzureManagedIdentity** id-ingest-worker-8b32
- `n01_8b32/id-release-agent`: **AzureManagedIdentity** id-release-agent-8b32
- `n16_8b32/id-partner-sync`: **AzureManagedIdentity** id-partner-sync-8b32
- `n42_8b32/cnt-partner-inbox`: **AzureStorageContainer** cnt-partner-inbox-8b32
- `n05_8b32/id-reporting-reader`: **AzureManagedIdentity** id-reporting-reader-8b32
- `n31_8b32/cnt-report-exports`: **AzureStorageContainer** cnt-report-exports-8b32
- `n08_8b32/cnt-marketing-downloads`: **AzureStorageContainer** cnt-marketing-downloads-8b32
- `n18_8b32/cnt-open-data`: **AzureStorageContainer** cnt-open-data-8b32
- `n28_8b32/kv-backup-keys`: **AzureKeyVault** kv-backup-keys-8b32
- `n43_8b32/cnt-backup-vault`: **AzureStorageContainer** cnt-backup-vault-8b32
- `n20_8b32/backup-archives`: **DataSet** backup-archives-8b32
- `n30_8b32/kv-billing-keys`: **AzureKeyVault** kv-billing-keys-8b32
- `n15_8b32/cnt-billing-statements`: **AzureStorageContainer** cnt-billing-statements-8b32
- `n14_8b32/billing-statements`: **DataSet** billing-statements-8b32
- `n11_8b32/kv-backup-keys`: **AzureKeyVault** kv-backup-keys-2-8b32
- `n13_8b32/cnt-backup-vault`: **AzureStorageContainer** cnt-backup-vault-2-8b32
- `n27_8b32/backup-archives`: **DataSet** backup-archives-2-8b32
- `n21_8b32/app-internal-wiki`: **AzureAppService** app-internal-wiki-8b32
- `n02_8b32/app-release-notes`: **AzureAppService** app-release-notes-8b32
- `n34_8b32/id-log-forwarder`: **AzureManagedIdentity** id-log-forwarder-8b32
- `n32_8b32/id-health-probe`: **AzureManagedIdentity** id-health-probe-8b32
- `n23_8b32/cnt-reporting-store`: **AzureStorageContainer** cnt-reporting-store-8b32
- `n00_8b32/reporting-store`: **DataSet** reporting-store-8b32
- `n38_8b32/cnt-ops-metrics`: **AzureStorageContainer** cnt-ops-metrics-8b32
- `n36_8b32/operational-metrics`: **DataSet** operational-metrics-8b32
- `n12_8b32/app-status-page`: **AzureAppService** app-status-page-8b32
- `n22_8b32/id-monitoring-agent`: **AzureManagedIdentity** id-monitoring-agent-8b32
- `n24_8b32/rg-build-agents`: **AzureResourceGroup** rg-build-agents-8b32
- `n39_8b32/app-internal-wiki`: **AzureAppService** app-internal-wiki-2-8b32
- `n19_8b32/cnt-telemetry-sink`: **AzureStorageContainer** cnt-telemetry-sink-8b32
- `n10_8b32/telemetry-sink`: **DataSet** telemetry-sink-8b32
- `n26_8b32/cnt-diag-logs`: **AzureStorageContainer** cnt-diag-logs-8b32
- `n25_8b32/id-monitoring-agent`: **AzureManagedIdentity** id-monitoring-agent-2-8b32
- `n29_8b32/kv-build-signing`: **AzureKeyVault** kv-build-signing-8b32
- `n03_8b32/cnt-reporting-store`: **AzureStorageContainer** cnt-reporting-store-2-8b32
- `n41_8b32/reporting-store`: **DataSet** reporting-store-2-8b32

## Relationships

- `n07_8b32/sub-corp-prod` --organizational_child--> `n17_8b32/rg-workloads`
- `n17_8b32/rg-workloads` --organizational_child--> `n40_8b32/app-service-frontend`
- `n40_8b32/app-service-frontend` --assumes--> `n04_8b32/id-app-service-frontend`
- `n04_8b32/id-app-service-frontend` --assumes--> `n33_8b32/id-cache-warmer`
- `n33_8b32/id-cache-warmer` --assumes--> `n35_8b32/id-ingest-worker`
- `n35_8b32/id-ingest-worker` --assumes--> `n01_8b32/id-release-agent`
- `n01_8b32/id-release-agent` --can_read--> `n37_8b32/kv-corp-secrets`
- `n37_8b32/kv-corp-secrets` --can_read--> `n06_8b32/cnt-customer-financials`
- `n06_8b32/cnt-customer-financials` --stores_sensitive_data--> `n09_8b32/customer-financials`
- `n16_8b32/id-partner-sync` --can_read--> `n42_8b32/cnt-partner-inbox`
- `n05_8b32/id-reporting-reader` --can_read--> `n31_8b32/cnt-report-exports`
- `n28_8b32/kv-backup-keys` --can_read--> `n43_8b32/cnt-backup-vault`
- `n43_8b32/cnt-backup-vault` --stores_sensitive_data--> `n20_8b32/backup-archives`
- `n30_8b32/kv-billing-keys` --can_read--> `n15_8b32/cnt-billing-statements`
- `n15_8b32/cnt-billing-statements` --stores_sensitive_data--> `n14_8b32/billing-statements`
- `n11_8b32/kv-backup-keys` --can_read--> `n13_8b32/cnt-backup-vault`
- `n13_8b32/cnt-backup-vault` --stores_sensitive_data--> `n27_8b32/backup-archives`
- `n23_8b32/cnt-reporting-store` --stores_sensitive_data--> `n00_8b32/reporting-store`
- `n38_8b32/cnt-ops-metrics` --stores_sensitive_data--> `n36_8b32/operational-metrics`
- `n19_8b32/cnt-telemetry-sink` --stores_sensitive_data--> `n10_8b32/telemetry-sink`
- `n03_8b32/cnt-reporting-store` --stores_sensitive_data--> `n41_8b32/reporting-store`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub