azure-aml-aks-attached-compute-job-submit

Submit a job to an AKS cluster attached as an AML compute target; the job runs inside the AKS cluster as a Kubernetes workload, enabling lateral movement to non-AML K8s resources.

derived azure emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`<principal>`
target	`<AKS cluster (ContainerCluster)`
permissions	`Microsoft.MachineLearningServices/workspaces/jobs/write`
conditions	`service_state` `role_compatibility`
state logic	ACTIVE when the attached AKS cluster is accessible and a job can be submitted. The job runs as a K8s workload within the AKS cluster, subject to the K8s RBAC and network policies of the AKS cluster (not AML RBAC). Cite cicd-chains for the injection pattern.

source type

Identity

source

<principal>

target

<AKS cluster (ContainerCluster)

permissions

Microsoft.MachineLearningServices/workspaces/jobs/write

conditions

service_state role_compatibility

state logic

ACTIVE when the attached AKS cluster is accessible and a job can be submitted. The job runs as a K8s workload within the AKS cluster, subject to the K8s RBAC and network policies of the AKS cluster (not AML RBAC). Cite cicd-chains for the injection pattern.

Narrative

{principal.name} can submit a job to AML compute {compute.name} (workspaces/jobs/write), which is backed by AKS cluster {k8sCluster.name}; the job runs as a Kubernetes workload inside AKS, enabling lateral movement within the AKS cluster beyond AML isolation.

Raw rule rules/derived/azure/machinelearning.yaml

id: azure-aml-aks-attached-compute-job-submit
emits: CanModifyCode
description: Submit a job to an AKS cluster attached as an AML compute target; the job runs inside the
  AKS cluster as a Kubernetes workload, enabling lateral movement to non-AML K8s resources.
match:
- - principal: null
  - CanModifyCode
  - compute: null
- - compute: null
  - Contains
  - k8sCluster: null
where:
- node_type(?compute) in [Compute]
- ?compute.kind == AKS (AML attached AKS compute target)
- node_type(?k8sCluster) in [ContainerCluster, KubernetesCluster]
emit:
  source_type: Identity
  source: <principal>
  target: <AKS cluster (ContainerCluster)
  permissions:
  - Microsoft.MachineLearningServices/workspaces/jobs/write
  conditions:
  - service_state
  - role_compatibility
  state_logic: ACTIVE when the attached AKS cluster is accessible and a job can be submitted. The job
    runs as a K8s workload within the AKS cluster, subject to the K8s RBAC and network policies of the
    AKS cluster (not AML RBAC). Cite cicd-chains for the injection pattern.
  false_positive_note: This path exists only for AKS-attached computes (compute.kind == AKS). Standard
    AML managed computes (AmlCompute, ComputeInstance) run in AML-managed environments and do not enable
    lateral K8s movement. The attacker code runs inside the AKS cluster; escalation from there depends
    on AKS RBAC and K8s network policies, not AML identity.
  note: "AKS-attached AML compute is a container-chains attack path: AML job submission \u2192 Kubernetes\
    \ workload \u2192 K8s node access / service account escalation. Link to container-chains.yaml for\
    \ the K8s traversal rules."
  narrative: '{principal.name} can submit a job to AML compute {compute.name} (workspaces/jobs/write),
    which is backed by AKS cluster {k8sCluster.name}; the job runs as a Kubernetes workload inside AKS,
    enabling lateral movement within the AKS cluster beyond AML isolation.'