rage.fail

azure-aml-amlcompute-executes-as-system-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "identity.type", "resource_type": "Microsoft.MachineLearningServices/workspaces/computes", "value_contains": "SystemAssigned" }

where

compute.kind == AmlCompute OR compute.kind == ComputeInstance

emit

source type	`Compute`
target type	`ManagedIdentity`
source	`<AML compute cluster or compute instance>`
target	`<system-assigned MI (identity.principalId on the compute)>`

Narrative

AML compute {compute.name} (SystemAssigned) executes as managed identity {mi.principalId}.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-amlcompute-executes-as-system-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/computes
  field: identity.type
  value_contains: SystemAssigned
where:
- compute.kind == AmlCompute OR compute.kind == ComputeInstance
emit:
  source_type: Compute
  target_type: ManagedIdentity
  source: <AML compute cluster or compute instance>
  target: <system-assigned MI (identity.principalId on the compute)>
  api_source: GET /...workspaces/{ws}/computes/{name}
  evidence_field: identity.type + identity.principalId
  narrative: AML compute {compute.name} (SystemAssigned) executes as managed identity {mi.principalId}.