azure-aml-datastore-exposes-cred
An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that credential to principals with listsecrets.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?datastore) in [Data,
GenericData]
node_type(?credential) in [Secret, ConnectionString, AccessKey, Credential]
datastore.credential_type in [accountKey, sas, servicePrincipal, certificate]
emit
| source type | Data |
|---|---|
| target type | Credential |
| source | <AML datastore> |
| target | <stored credential (storage key / SAS / SP client secret / cert)> |
| permissions | Microsoft.MachineLearningServices/workspaces/datastores/listsecrets/action |
Narrative
{datastore.name} is configured with a static credential ({credential.type}) retrievable via listsecrets/action; this credential authenticates to the backing data store.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-datastore-exposes-cred
emits: ExposesCredential
description: An AML datastore configured with accountKey/SAS/servicePrincipal credential exposes that
credential to principals with listsecrets.
match:
- - datastore: null
- ContainsSecret
- credential: null
where:
- node_type(?datastore) in [Data, GenericData]
- node_type(?credential) in [Secret, ConnectionString, AccessKey, Credential]
- datastore.credential_type in [accountKey, sas, servicePrincipal, certificate]
emit:
source_type: Data
target_type: Credential
source: <AML datastore>
target: <stored credential (storage key / SAS / SP client secret / cert)>
permissions:
- Microsoft.MachineLearningServices/workspaces/datastores/listsecrets/action
derived_from:
- <ContainsSecret edge_id>
false_positive_note: Only emit when the datastore credential_type is a static credential (accountKey,
sas, servicePrincipal, certificate). Identity/MI-backed datastores have no stored credential to expose.
This edge is consumed by credential-chains read-secret-yields-identity when the credential is CredentialsFor
an identity.
narrative: '{datastore.name} is configured with a static credential ({credential.type}) retrievable
via listsecrets/action; this credential authenticates to the backing data store.'