azure-adf-dataflow-write-modifycode
Overwrite an ADF Data Flow definition to inject attacker transformation logic running on the factory's Spark/IR cluster as the factory MI.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/dataflows/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <ADF Data Flow (Workflow node)> |
| permissions | Microsoft.DataFactory/factories/dataflows/write |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists) — realized when a pipeline that references this Data Flow executes (via schedule trigger or createRun). ACTIVE if a confirmed trigger pipeline exists AND the principal can trigger it. BLOCKED if a deny assignment covers dataflows/write. |
Narrative
{principal.name} can overwrite the Data Flow {target.name} definition (Microsoft.DataFactory/factories/dataflows/write), injecting attacker transformation logic that runs on the factory's Spark cluster as the factory MI when the parent pipeline is triggered.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-dataflow-write-modifycode
emits: CanModifyCode
description: Overwrite an ADF Data Flow definition to inject attacker transformation logic running on
the factory's Spark/IR cluster as the factory MI.
match_effective_permission:
action: Microsoft.DataFactory/factories/dataflows/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <ADF Data Flow (Workflow node)>
permissions:
- Microsoft.DataFactory/factories/dataflows/write
conditions:
- trigger_exists
state_logic: "CONDITIONAL(trigger_exists) \u2014 realized when a pipeline that references this Data\
\ Flow executes (via schedule trigger or createRun). ACTIVE if a confirmed trigger pipeline exists\
\ AND the principal can trigger it. BLOCKED if a deny assignment covers dataflows/write."
confidence: 0.85
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/dataflows/write'
false_positive_note: "A Data Flow is executed by a pipeline Execute Data Flow activity \u2014 the Data\
\ Flow definition itself is not a standalone runnable. CanModifyCode here means the attacker controls\
\ the transformation logic the pipeline executes; it still requires a pipeline trigger to realize.\
\ Lower confidence than pipelines/write because the Spark-based execution surface adds an IR/cluster\
\ layer."
narrative: '{principal.name} can overwrite the Data Flow {target.name} definition (Microsoft.DataFactory/factories/dataflows/write),
injecting attacker transformation logic that runs on the factory''s Spark cluster as the factory MI
when the parent pipeline is triggered.'