services / Azure / Key Vault managed storage account SAS definition

A SAS definition is a template under a Key Vault managed storage account that specifies the type, permissions, and validity of the Shared Access Signature tokens the vault mints for the backing storage account; the resulting tokens are exposed as vault secrets.

Controlling a SAS definition controls what delegated access tokens the vault issues for the underlying storage account's data, making it a CRITICAL credential-issuance asset.

Microsoft.​KeyVault/​Vaults/​storageAccounts/​sas/​set/​action

Creates or updates a SAS definition, letting an attacker mint a SAS template with attacker-chosen permissions and validity over the backing storage account, establishing a durable self-service credential and a path to the underlying storage data.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links