azure-aml-computeinstance-ssh-access

id: azure-aml-computeinstance-ssh-access
emits: CanExecuteCommand
applies_to:
- azure
description: SSH access to a running compute instance when SSH is enabled and the principal controls the
  SSH private key.
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/computes
  field: properties.sshSettings
where:
- properties.sshSettings.sshPublicAccess == Enabled
- compute.kind == ComputeInstance
- evidence shows SSH public key is set and the attacker can demonstrate key control
emit:
  source_type: Identity
  target_type: VirtualMachine
  source: <principal with SSH key control>
  target: <compute instance>
  permissions:
  - Microsoft.MachineLearningServices/workspaces/computes/write
  api_source: GET /...workspaces/{ws}/computes/{name} + SSH key evidence
  evidence_field: properties.sshSettings.sshPublicAccess + key material or computes/write evidence
  conditions:
  - network_reachability
  - service_state
  - role_compatibility
  false_positive_note: 'Emit ACTIVE only when evidence shows: (a) SSH is enabled (sshPublicAccess=Enabled),
    (b) the instance is running, (c) SSH public key is set on the instance, and (d) the attacker can demonstrate
    private-key control (either by credential in evidence or by computes/write permission allowing key
    replacement). Do not emit for instances with SSH disabled or when SSH key is controlled by a different
    principal.'
  narrative: '{principal.name} can SSH to compute instance {target.name} (SSH enabled, {principal.name}
    controls the SSH private key) and run OS commands as the instance''s managed identity.'