azure-aml-per-job-identity-override

Submit a job specifying identity.client_id to override the cluster-default MI with a chosen user-assigned MI for that run.

explicit azure emits CanPassIdentity

match (effective permission)

{ "action": "Microsoft.MachineLearningServices/workspaces/jobs/write", "scope_type": "resource|resourceGroup|subscription" }

where

the job spec can include an identity block with type=managed and client_id of a user-assigned MI accessible to the workspace

emit

source typeIdentity
target typeManagedIdentity
source<principal>
target<user-assigned MI referenced by client_id in the job spec>
permissionsMicrosoft.MachineLearningServices/workspaces/jobs/write
conditionsrole_compatibility
state logicACTIVE when the referenced user-assigned MI is already assigned to the workspace compute or explicitly listed in the workspace identity block. CONDITIONAL(role_compatibility) when MI accessibility to the workspace cannot be confirmed from collected data — the job may fail at submission if the MI is not accessible.

Narrative

{principal.name} can submit a job (workspaces/jobs/write) with an identity override specifying user-assigned MI {target.name}, executing the job's code as that MI instead of the cluster default.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-per-job-identity-override
emits: CanPassIdentity
applies_to:
- azure
description: Submit a job specifying identity.client_id to override the cluster-default MI with a chosen
  user-assigned MI for that run.
match_effective_permission:
  action: Microsoft.MachineLearningServices/workspaces/jobs/write
  scope_type: resource|resourceGroup|subscription
where:
- the job spec can include an identity block with type=managed and client_id of a user-assigned MI accessible
  to the workspace
emit:
  source_type: Identity
  target_type: ManagedIdentity
  source: <principal>
  target: <user-assigned MI referenced by client_id in the job spec>
  permissions:
  - Microsoft.MachineLearningServices/workspaces/jobs/write
  conditions:
  - role_compatibility
  api_source: job submission with identity override block
  evidence_field: workspaces/jobs/write + identity.client_id parameter
  state_logic: "ACTIVE when the referenced user-assigned MI is already assigned to the workspace compute\
    \ or explicitly listed in the workspace identity block. CONDITIONAL(role_compatibility) when MI accessibility\
    \ to the workspace cannot be confirmed from collected data \u2014 the job may fail at submission if\
    \ the MI is not accessible."
  false_positive_note: The referenced MI must be accessible to the workspace (assigned to the compute
    resource or workspace). An arbitrary MI client_id not pre-assigned to the workspace will fail at job
    submission. Emit CONDITIONAL when accessibility is unconfirmed. This is the AML iam:PassRole equivalent;
    it only grants the identity for the duration of the job, not persistently.
  narrative: '{principal.name} can submit a job (workspaces/jobs/write) with an identity override specifying
    user-assigned MI {target.name}, executing the job''s code as that MI instead of the cluster default.'
move · open · esc close