azure-adf-storage-event-trigger-binding
An ADF Storage Events or Custom Events trigger binds a storage/Event Grid source to a pipeline; writing to that source drives the pipeline run.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?storage is a Storage/
EventBus node that is bound as the trigger source of an ADF pipeline via a StorageEventsTrigger or CustomEventsTrigger
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal with CanWriteData on the trigger source storage/event bus> |
| target | <ADF pipeline triggered by the storage/event source> |
| conditions | trigger_exists service_state |
| state logic | ACTIVE when the ADF trigger is Enabled AND the principal can write to the trigger source (blob create/delete for StorageEventsTrigger, event publish for CustomEventsTrigger). CONDITIONAL(service_state) when the trigger is Stopped. CONDITIONAL(trigger_exists) when the trigger configuration is unconfirmed. cicd-chains cicd-trigger-runner-executes-as and messaging-chains messaging-trigger-executes-as own the CanTrigger + ExecutesAs collapse; cite, do not re-derive CanExecuteAs here. |
Narrative
{principal.name} can write to storage/event source {storage.name}, which is bound as the trigger source for ADF pipeline {target.name}; writing to it fires the pipeline and runs it as the factory MI.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-storage-event-trigger-binding
emits: CanTrigger
description: An ADF Storage Events or Custom Events trigger binds a storage/Event Grid source to a pipeline;
writing to that source drives the pipeline run.
match:
- - source: null
- CanWriteData
- storage: null
where:
- ?storage is a Storage/EventBus node that is bound as the trigger source of an ADF pipeline via a StorageEventsTrigger
or CustomEventsTrigger
emit:
source_type: Identity
target_type: Workflow
source: <principal with CanWriteData on the trigger source storage/event bus>
target: <ADF pipeline triggered by the storage/event source>
permissions: []
conditions:
- trigger_exists
- service_state
state_logic: ACTIVE when the ADF trigger is Enabled AND the principal can write to the trigger source
(blob create/delete for StorageEventsTrigger, event publish for CustomEventsTrigger). CONDITIONAL(service_state)
when the trigger is Stopped. CONDITIONAL(trigger_exists) when the trigger configuration is unconfirmed.
cicd-chains cicd-trigger-runner-executes-as and messaging-chains messaging-trigger-executes-as own
the CanTrigger + ExecutesAs collapse; cite, do not re-derive CanExecuteAs here.
confidence: 0.82
derived_from:
- '<CanWriteData edge: ?principal -> ?storage>'
- '<CanTrigger edge: ?storage -> ?pipeline (from explicit azure-adf-trigger-event-source-binding)>'
false_positive_note: "StorageEventsTrigger is activated by Azure Event Grid blob events (create, delete)\
\ on the specified container \u2014 only principals who can create/delete blobs in that container\
\ drive the trigger. CustomEventsTrigger is activated by Event Grid custom events matching a filter\
\ \u2014 only principals who can publish matching events drive it. A write to a different container\
\ or topic does NOT activate the trigger. Confirm the trigger is Enabled (not Stopped) before emitting\
\ ACTIVE. The CanExecuteAs collapse is owned by cicd-chains and messaging-chains; do not re-derive."
narrative: '{principal.name} can write to storage/event source {storage.name}, which is bound as the
trigger source for ADF pipeline {target.name}; writing to it fires the pipeline and runs it as the
factory MI.'