rage.fail

azure-aml-datastore-accountkey-contains-secret

explicit azure emits ContainsSecret

match (record)

{ "field": "properties.credentials.credentialsType", "resource_type": "Microsoft.MachineLearningServices/workspaces/datastores", "value": "AccountKey" }

emit

source type	`Data`
target type	`Secret`
source	`<AML datastore>`
target	`<storage account key (AccessKey)>`

Narrative

AML datastore {datastore.name} stores a storage account key credential, retrievable via datastores/listsecrets/action.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-datastore-accountkey-contains-secret
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/datastores
  field: properties.credentials.credentialsType
  value: AccountKey
emit:
  source_type: Data
  target_type: Secret
  source: <AML datastore>
  target: <storage account key (AccessKey)>
  api_source: GET /...workspaces/{ws}/datastores/{name}
  evidence_field: properties.credentials.credentialsType == AccountKey
  narrative: AML datastore {datastore.name} stores a storage account key credential, retrievable via datastores/listsecrets/action.