rage.fail

azure-aml-connection-apikey-contains-credential

explicit azure emits ContainsCredential

match (record)

{ "field": "properties.authType", "resource_type": "Microsoft.MachineLearningServices/workspaces/connections", "value_in": [ "ApiKey", "CustomKeys", "AccountKey" ] }

where

properties.category in [AzureOpenAI, CognitiveService, CustomKeys, AzureBlob, ApiKey, Serverless]

emit

source type	`Data`
target type	`Credential`
source	`<AML workspace connection>`
target	`<API key or connection string (APIKey / ConnectionString)>`

Narrative

AML workspace connection {connection.name} (category: {category}) stores a {authType} credential retrievable via connections/listsecrets/action.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-connection-apikey-contains-credential
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/connections
  field: properties.authType
  value_in:
  - ApiKey
  - CustomKeys
  - AccountKey
where:
- properties.category in [AzureOpenAI, CognitiveService, CustomKeys, AzureBlob, ApiKey, Serverless]
emit:
  source_type: Data
  target_type: Credential
  source: <AML workspace connection>
  target: <API key or connection string (APIKey / ConnectionString)>
  api_source: GET /...workspaces/{ws}/connections/{name}
  evidence_field: properties.authType + properties.category
  narrative: 'AML workspace connection {connection.name} (category: {category}) stores a {authType} credential
    retrievable via connections/listsecrets/action.'