azure-adf-linkedservice-exposes-cred

An ADF linked service stores a long-lived embedded credential (connection string, storage key, SP secret) exposed to pipeline runs.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Data`
target type	`Identity`
source	`<linked service (ConnectionString node)>`
target	`<identity/service the embedded credential authenticates as>`
state logic	ACTIVE when the linked service has confirmed stored inline credential material. CONDITIONAL when the credential is a Key Vault-backed secret reference (not inline — must resolve KV access separately).

source type

Data

target type

Identity

source

<linked service (ConnectionString node)>

target

<identity/service the embedded credential authenticates as>

state logic

ACTIVE when the linked service has confirmed stored inline credential material. CONDITIONAL when the credential is a Key Vault-backed secret reference (not inline — must resolve KV access separately).

Narrative

Linked service {linkedservice.name} stores an embedded credential (connection string / storage key / client secret) exposed to any pipeline run that uses it, and readable by principals holding linkedservices/read.

Raw rule rules/derived/azure/datafactory.yaml

id: azure-adf-linkedservice-exposes-cred
emits: ExposesCredential
description: An ADF linked service stores a long-lived embedded credential (connection string, storage
  key, SP secret) exposed to pipeline runs.
match:
- - linkedservice: null
  - ContainsSecret
  - cred: null
where:
- node_type(?linkedservice) == ConnectionString or node_class(?linkedservice) == Data
- ?linkedservice is a Microsoft.DataFactory/factories/linkedservices resource
emit:
  source_type: Data
  target_type: Identity
  source: <linked service (ConnectionString node)>
  target: <identity/service the embedded credential authenticates as>
  permissions: []
  conditions: []
  state_logic: "ACTIVE when the linked service has confirmed stored inline credential material. CONDITIONAL\
    \ when the credential is a Key Vault-backed secret reference (not inline \u2014 must resolve KV access\
    \ separately)."
  confidence: 0.88
  derived_from:
  - '<ContainsSecret edge: ?linkedservice -> ?cred>'
  false_positive_note: The embedded credential is accessible to all pipeline runs using this linked service
    (the ADF runtime decrypts it at run time). It is also accessible to any principal holding linkedservices/read
    (rule azure-adf-linkedservice-read-secret). The target identity is the service the credential authenticates
    to (SQL server, storage account, external API, Service Bus namespace). credential-chains rolls up
    ContainsSecret + CredentialsFor -> downstream access edges; this rule emits only the ExposesCredential
    fact.
  narrative: Linked service {linkedservice.name} stores an embedded credential (connection string / storage
    key / client secret) exposed to any pipeline run that uses it, and readable by principals holding
    linkedservices/read.