azure-aml-create-compute-with-mi

Create a new AML compute bound to a chosen user-assigned MI, then submit a job to it - execute as that MI.

derived azure emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ManagedIdentity`
source	`<principal>`
target	`<user-assigned managed identity>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.MachineLearningServices/workspaces/computes/write` `Microsoft.MachineLearningServices/workspaces/jobs/write`
conditions	`role_compatibility` `service_state`
state logic	POTENTIAL until the compute is created (computes/write) and a job is submitted (jobs/write); ACTIVE once both steps are executed and the compute has a running node. Emit POTENTIAL when the create steps are not yet materialized.

source type

Identity

target type

ManagedIdentity

source

<principal>

target

<user-assigned managed identity>

permissions

Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.MachineLearningServices/workspaces/computes/write Microsoft.MachineLearningServices/workspaces/jobs/write

conditions

role_compatibility service_state

state logic

POTENTIAL until the compute is created (computes/write) and a job is submitted (jobs/write); ACTIVE once both steps are executed and the compute has a running node. Emit POTENTIAL when the create steps are not yet materialized.

Narrative

{principal.name} can create a new AML compute cluster (computes/write) bound to user-assigned MI {target.name} (assign/action), then submit a job (jobs/write) to execute attacker code as {target.name}.

Raw rule rules/derived/azure/machinelearning.yaml

id: azure-aml-create-compute-with-mi
emits: CanCreateWorkloadAs
description: "Create a new AML compute bound to a chosen user-assigned MI, then submit a job to it \u2014\
  \ execute as that MI."
match:
- - principal: null
  - CanPassIdentity
  - userMI: null
where:
- ?principal has EFFECTIVE Microsoft.MachineLearningServices/workspaces/computes/write (create new compute)
- ?principal has EFFECTIVE Microsoft.MachineLearningServices/workspaces/jobs/write (job submit)
- ?principal has EFFECTIVE Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on ?userMI
emit:
  source_type: Identity
  target_type: ManagedIdentity
  source: <principal>
  target: <user-assigned managed identity>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.MachineLearningServices/workspaces/computes/write
  - Microsoft.MachineLearningServices/workspaces/jobs/write
  conditions:
  - role_compatibility
  - service_state
  state_logic: POTENTIAL until the compute is created (computes/write) and a job is submitted (jobs/write);
    ACTIVE once both steps are executed and the compute has a running node. Emit POTENTIAL when the create
    steps are not yet materialized.
  derived_from:
  - <CanPassIdentity edge_id>
  false_positive_note: 'All three permissions are required: assign/action on the MI, computes/write to
    create the compute, and jobs/write to submit a job. Without jobs/write the compute exists but no code
    runs. Escalation only if the attached MI out-privileges the caller. The new compute node must provision
    before the job can run; emit CONDITIONAL(service_state) during provisioning.'
  narrative: '{principal.name} can create a new AML compute cluster (computes/write) bound to user-assigned
    MI {target.name} (assign/action), then submit a job (jobs/write) to execute attacker code as {target.name}.'