rage.fail

azure-aml-amlcompute-executes-as-user-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "identity.userAssignedIdentities", "resource_type": "Microsoft.MachineLearningServices/workspaces/computes" }

where

identity.type contains UserAssigned identity.userAssignedIdentities is not empty

emit

source type	`Compute`
target type	`ManagedIdentity`
source	`<AML compute cluster or compute instance>`
target	`<each user-assigned MI in identity.userAssignedIdentities (keyed by MI resource ID)>`

Narrative

AML compute {compute.name} (UserAssigned) executes as user-assigned MI {mi.name}.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-amlcompute-executes-as-user-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/computes
  field: identity.userAssignedIdentities
where:
- identity.type contains UserAssigned
- identity.userAssignedIdentities is not empty
emit:
  source_type: Compute
  target_type: ManagedIdentity
  source: <AML compute cluster or compute instance>
  target: <each user-assigned MI in identity.userAssignedIdentities (keyed by MI resource ID)>
  api_source: GET /...workspaces/{ws}/computes/{name}
  evidence_field: identity.userAssignedIdentities
  note: Each key in userAssignedIdentities is a Microsoft.ManagedIdentity/userAssignedIdentities resource
    ID. Emit one ExecutesAs per MI.
  narrative: AML compute {compute.name} (UserAssigned) executes as user-assigned MI {mi.name}.