azure-aml-compute-write-config
Write to a compute cluster - changes the compute identity block, SSH keys, subnet, or init scripts.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/computes/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
target is a compute cluster (
BatchJob / AmlCompute), not a compute instance
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <AML compute cluster> |
| permissions | Microsoft.MachineLearningServices/workspaces/computes/write |
Narrative
{principal.name} can modify the configuration of compute {target.name} (computes/write), including its managed identity block and initialization scripts.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-compute-write-config
emits: CanModifyConfiguration
description: "Write to a compute cluster \u2014 changes the compute identity block, SSH keys, subnet,\
\ or init scripts."
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/computes/write
scope_type: resource|resourceGroup|subscription
where:
- target is a compute cluster (BatchJob / AmlCompute), not a compute instance
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <AML compute cluster>
permissions:
- Microsoft.MachineLearningServices/workspaces/computes/write
note: "Can change the identity block (attach user-assigned MI), SSH key, subnet placement, custom data\
\ / init scripts. Identity block changes do NOT propagate to already-running compute nodes \u2014\
\ recreate / scale-to-zero is required for the new MI to take effect on nodes."
false_positive_note: In-place identity block updates on a running cluster do not reach currently-active
nodes; new nodes will use the updated MI. Scale-to-zero then scale-up is required for full propagation,
so emit CONDITIONAL(service_state) for the MI-swap path.
narrative: '{principal.name} can modify the configuration of compute {target.name} (computes/write),
including its managed identity block and initialization scripts.'