azure-aml-computeinstance-ssh
Write access to a compute instance can modify SSH public key configuration and other network settings.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/computes/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
target is a compute instance (not a managed compute cluster)
emit
| source type | Identity |
|---|---|
| target type | VirtualMachine |
| source | <principal> |
| target | <compute instance> |
| permissions | Microsoft.MachineLearningServices/workspaces/computes/write |
| conditions | network_reachability role_compatibility |
| state logic | ACTIVE for the CanModifyConfiguration capability itself. CanExecuteCommand can be derived only when the attacker ALSO holds or can obtain the SSH private key corresponding to a public key they set, or when SSH is already enabled and a trusted public key is configured that the attacker holds the private key for. Emit CONDITIONAL(role_compatibility) when SSH key possession cannot be verified. |
Narrative
{principal.name} can modify the configuration of compute instance {target.name} (computes/write), including SSH public key settings.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-computeinstance-ssh
emits: CanModifyConfiguration
description: Write access to a compute instance can modify SSH public key configuration and other network
settings.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/computes/write
scope_type: resource|resourceGroup|subscription
where:
- target is a compute instance (not a managed compute cluster)
emit:
source_type: Identity
target_type: VirtualMachine
source: <principal>
target: <compute instance>
permissions:
- Microsoft.MachineLearningServices/workspaces/computes/write
conditions:
- network_reachability
- role_compatibility
state_logic: ACTIVE for the CanModifyConfiguration capability itself. CanExecuteCommand can be derived
only when the attacker ALSO holds or can obtain the SSH private key corresponding to a public key
they set, or when SSH is already enabled and a trusted public key is configured that the attacker
holds the private key for. Emit CONDITIONAL(role_compatibility) when SSH key possession cannot be
verified.
false_positive_note: 'Having computes/write does NOT imply CanExecuteCommand without evidence that:
(a) SSH is enabled on the instance (enableNodePublicIp=true), (b) a public SSH key is configured,
and (c) the attacker holds the corresponding private key OR can set their own. A principal with computes/write
but no private key and who cannot update the SSH configuration cannot SSH in. Do not emit CanExecuteCommand;
emit CanModifyConfiguration. The downstream execute-as-via-command linchpin can derive CanExecuteAs
only when SSH access is independently confirmed.'
narrative: '{principal.name} can modify the configuration of compute instance {target.name} (computes/write),
including SSH public key settings.'