azure-aml-job-run-trigger
Principal can trigger an existing AML job/pipeline run, executing the current job definition as the cluster MI.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/jobs/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | BatchJob |
| source | <principal> |
| target | <AML compute cluster (BatchJob)> |
| permissions | Microsoft.MachineLearningServices/workspaces/jobs/write |
Narrative
{principal.name} can trigger AML job runs (jobs/write); escalation depends on whether the triggered job definition runs attacker-influenced code.
Raw rule rules/explicit/azure-machinelearning.yaml
id: azure-aml-job-run-trigger
emits: CanTrigger
applies_to:
- azure
description: Principal can trigger an existing AML job/pipeline run, executing the current job definition
as the cluster MI.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/jobs/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: BatchJob
source: <principal>
target: <AML compute cluster (BatchJob)>
permissions:
- Microsoft.MachineLearningServices/workspaces/jobs/write
api_source: role assignment evaluation
evidence_field: roleAssignments.properties.roleDefinitionId
note: Triggering a job runs the CURRENT definition. Escalation to the cluster MI only occurs if the
current job definition contains attacker-influenced code (poisoned dependency, attacker-authored script,
mutable environment image).
false_positive_note: Triggering a trusted, pinned, reviewed job definition is NOT code execution under
attacker control. Only escalates when the current job definition demonstrably runs attacker-influenced
code.
narrative: '{principal.name} can trigger AML job runs (jobs/write); escalation depends on whether the
triggered job definition runs attacker-influenced code.'