azure-aml-component-write
Overwrite a shared pipeline component definition; future pipeline jobs using that component run attacker code as the cluster MI.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/components/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <AML compute cluster (BatchJob)> |
| permissions | Microsoft.MachineLearningServices/workspaces/components/write |
| conditions | trigger_exists |
| state logic | CONDITIONAL(trigger_exists) — the component is overwritten but only reaches execution when a pipeline job referencing that component runs. ACTIVE when a pipeline schedule already references the component. |
Narrative
{principal.name} can overwrite pipeline component {component.name} (workspaces/components/write); future pipeline jobs referencing it will execute the attacker's code on cluster {target.name} as its managed identity.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-component-write
emits: CanModifyCode
description: Overwrite a shared pipeline component definition; future pipeline jobs using that component
run attacker code as the cluster MI.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/components/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
source: <principal>
target: <AML compute cluster (BatchJob)>
permissions:
- Microsoft.MachineLearningServices/workspaces/components/write
conditions:
- trigger_exists
state_logic: "CONDITIONAL(trigger_exists) \u2014 the component is overwritten but only reaches execution\
\ when a pipeline job referencing that component runs. ACTIVE when a pipeline schedule already references\
\ the component."
false_positive_note: Only affects FUTURE pipeline runs that reference the specific component by name/version.
An already-running job is not affected. Do not emit if the component is a private/pinned version that
no active pipeline references. Emit CONDITIONAL(trigger_exists) unless a pipeline schedule explicitly
references the component version.
narrative: '{principal.name} can overwrite pipeline component {component.name} (workspaces/components/write);
future pipeline jobs referencing it will execute the attacker''s code on cluster {target.name} as
its managed identity.'