azure-aml-online-endpoint-public
AML online endpoint with a public HTTPS URL and key-based auth is reachable from the internet; the scoring key is retrievable via listkeys.
where
onlineEndpoint publicNetworkAccess == Enabled (or not restricted to private endpoint)
onlineEndpoint authMode == Key
emit
| source type | Compute |
|---|---|
| target type | AnonymousIdentity |
| source | <AML online endpoint (API / PublicEndpoint)> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
AML online endpoint {endpoint.name} is reachable from the public internet (publicNetworkAccess=Enabled, authMode=Key); an attacker with the scoring key can invoke it, running the scoring script as the endpoint's managed identity.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-online-endpoint-public
emits: ExposedToInternet
description: AML online endpoint with a public HTTPS URL and key-based auth is reachable from the internet;
the scoring key is retrievable via listkeys.
where:
- onlineEndpoint publicNetworkAccess == Enabled (or not restricted to private endpoint)
- onlineEndpoint authMode == Key
emit:
source_type: Compute
target_type: AnonymousIdentity
source: <AML online endpoint (API / PublicEndpoint)>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Key-based authentication still requires the scoring key, which is retrievable via
onlineEndpoints/listkeys/action (Contributor/Owner or custom grant). Without the key, the endpoint
URL is public but not exploitable without the credential. Emit ACTIVE for the network reachability
fact; pair with a CanReadSecret for the key to build the full attack path. Do not emit for Token-authenticated
(AAD-only) or private-endpoint-only endpoints.
narrative: AML online endpoint {endpoint.name} is reachable from the public internet (publicNetworkAccess=Enabled,
authMode=Key); an attacker with the scoring key can invoke it, running the scoring script as the endpoint's
managed identity.