rage.fail

azure-aml-datastore-sp-contains-secret

explicit azure emits ContainsSecret

match (record)

{ "field": "properties.credentials.credentialsType", "resource_type": "Microsoft.MachineLearningServices/workspaces/datastores", "value": "ServicePrincipal" }

emit

source type	`Data`
target type	`Secret`
source	`<AML datastore>`
target	`<service principal client secret or certificate (Credential)>`

Narrative

AML datastore {datastore.name} stores a service principal client secret (tenantId: {tenantId}, clientId: {clientId}), retrievable via datastores/listsecrets/action.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-datastore-sp-contains-secret
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces/datastores
  field: properties.credentials.credentialsType
  value: ServicePrincipal
emit:
  source_type: Data
  target_type: Secret
  source: <AML datastore>
  target: <service principal client secret or certificate (Credential)>
  api_source: GET /...workspaces/{ws}/datastores/{name}
  evidence_field: properties.credentials.credentialsType == ServicePrincipal
  note: CredentialsFor the SP identified by clientId in the credential block; drives credential-chains
    read-secret-yields-identity.
  narrative: 'AML datastore {datastore.name} stores a service principal client secret (tenantId: {tenantId},
    clientId: {clientId}), retrievable via datastores/listsecrets/action.'