Azure EventGrid Access Key

Detects Azure Event Grid access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: structurally constrained Base64 pattern with Event Grid context keywords reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.
Detection quality: Verified
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Data categories: credentials, security
Scope: specific
Risk rating: 10
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)(?:aeg-sas-key|eventgrid[._-]?key|topic[._-]?key)\s*[:=]\s*"?[A-Za-z0-9+/\s]{40,54}={0,2}"?

Corroborative evidence keywords

Event Grid, EventGrid, aeg-sas-key, topic key, domain key, event subscription, access key, sas key, api key, api_key, apikey, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential (+44 more)

Proximity: 300 characters

Should match

aeg-sas-key=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== — Event Grid SAS key
eventgrid_key="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn==" — Event Grid key with mixed characters
topic_key=00000000000000000000000000000000000000000000 — Topic key with placeholder value

Should not match

aeg-sas-key=short — Too short to be a valid Event Grid key
topicEndpoint=https://mytopic.westus2-1.eventgrid.azure.net — Topic endpoint URL, not a key
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

Event Grid documentation and sample code with placeholder keys. Mitigation: Check for common placeholder patterns and documentation context.
Other SAS keys from different Azure services. Mitigation: Use Event Grid specific keywords to differentiate from other services.

References

Azure EventGrid access key entity definition - Microsoft Learn