azure-aml-notebook-write
Overwrite a notebook on the workspace file share (via storage write); the notebook runs on a compute instance as the compute MI.
match (effective permission)
{
"any_of": [
{
"action": "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
"note": "Storage Blob Data Contributor / Owner on the linked ADLS Gen2 / Blob storage account"
},
{
"action": "Microsoft.MachineLearningServices/workspaces/notebooks/write",
"note": "Direct notebook write via AML workspace API"
}
],
"scope_type": "resource|resourceGroup|subscription"
}
where
the write target is the workspace's linked storage account or the AML notebook file share
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <AML compute instance (Notebook / VirtualMachine)> |
| permissions | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write Microsoft.MachineLearningServices/workspaces/notebooks/write |
| conditions | trigger_exists |
| state logic | ACTIVE when a user is actively running the notebook interactively on a compute instance OR a job schedule already references the notebook. CONDITIONAL(trigger_exists) when no scheduled job or active session is established — the code is planted but needs a run path. |
Narrative
{principal.name} can overwrite a notebook on the AML workspace file share ({target.name}); the notebook executes as the compute instance's managed identity on the next interactive session or scheduled run.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-notebook-write
emits: CanModifyCode
description: Overwrite a notebook on the workspace file share (via storage write); the notebook runs on
a compute instance as the compute MI.
match_effective_permission:
any_of:
- action: Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
note: Storage Blob Data Contributor / Owner on the linked ADLS Gen2 / Blob storage account
- action: Microsoft.MachineLearningServices/workspaces/notebooks/write
note: Direct notebook write via AML workspace API
scope_type: resource|resourceGroup|subscription
where:
- the write target is the workspace's linked storage account or the AML notebook file share
emit:
source_type: Identity
source: <principal>
target: <AML compute instance (Notebook / VirtualMachine)>
permissions:
- Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
- Microsoft.MachineLearningServices/workspaces/notebooks/write
conditions:
- trigger_exists
state_logic: "ACTIVE when a user is actively running the notebook interactively on a compute instance\
\ OR a job schedule already references the notebook. CONDITIONAL(trigger_exists) when no scheduled\
\ job or active session is established \u2014 the code is planted but needs a run path."
false_positive_note: Only emit when the write target is the workspace's linked storage or notebook file
share, not arbitrary blob storage. The attacker must also have knowledge of the notebook path the
compute instance or job will run; a write to an unmonitored path is not code execution.
narrative: '{principal.name} can overwrite a notebook on the AML workspace file share ({target.name});
the notebook executes as the compute instance''s managed identity on the next interactive session
or scheduled run.'