rage.fail

azure-aml-datastore-sas-contains-secret

explicit azure emits ContainsSecret

match (record)

{ "field": "properties.credentials.credentialsType", "resource_type": "Microsoft.MachineLearningServices/workspaces/datastores", "value": "Sas" }

emit

source type	`Data`
target type	`Secret`
source	`<AML datastore>`
target	`<SAS token (Credential)>`

Narrative

AML datastore {datastore.name} stores a SAS token credential, retrievable via datastores/listsecrets/action.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-datastore-sas-contains-secret
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/datastores
  field: properties.credentials.credentialsType
  value: Sas
emit:
  source_type: Data
  target_type: Secret
  source: <AML datastore>
  target: <SAS token (Credential)>
  api_source: GET /...workspaces/{ws}/datastores/{name}
  evidence_field: properties.credentials.credentialsType == Sas
  narrative: AML datastore {datastore.name} stores a SAS token credential, retrievable via datastores/listsecrets/action.