azure-aml-online-deployment-write
Replace an online endpoint deployment's scoring script / model / environment; code executes as the endpoint MI on each inference request.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <online endpoint deployment (ContainerService)> |
| permissions | Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/write |
| conditions | trigger_exists |
| state logic | ACTIVE once the deployment is updated and receives an inference request (endpoint has active traffic allocation to the deployment). CONDITIONAL(trigger_exists) if no traffic is routed to this deployment. |
Narrative
{principal.name} can update online deployment {target.name} (onlineEndpoints/deployments/write), replacing the scoring script or container; attacker code runs as the endpoint's managed identity on each inference request.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-online-deployment-write
emits: CanModifyCode
description: Replace an online endpoint deployment's scoring script / model / environment; code executes
as the endpoint MI on each inference request.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
source: <principal>
target: <online endpoint deployment (ContainerService)>
permissions:
- Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/write
conditions:
- trigger_exists
state_logic: ACTIVE once the deployment is updated and receives an inference request (endpoint has active
traffic allocation to the deployment). CONDITIONAL(trigger_exists) if no traffic is routed to this
deployment.
false_positive_note: "Traffic must be routed to the deployment (non-zero traffic allocation). A deployment\
\ with 0% traffic does not execute on inference requests. The endpoint MI may be system-assigned (auto-created\
\ per endpoint) with limited privileges \u2014 verify the endpoint MI's RBAC before asserting a high-value\
\ escalation."
narrative: '{principal.name} can update online deployment {target.name} (onlineEndpoints/deployments/write),
replacing the scoring script or container; attacker code runs as the endpoint''s managed identity
on each inference request.'