azure-aml-role-assignment-write
Owner / User Access Administrator on the AML workspace or compute scope can grant AML roles to any principal, including itself.
match (effective permission)
{
"action": "Microsoft.Authorization/roleAssignments/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
scope covers the AML workspace or its parent resource group / subscription
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any principal> |
| permissions | Microsoft.Authorization/roleAssignments/write |
| conditions | iam_permission |
Narrative
{principal.name} can grant AML roles (e.g. AzureML Data Scientist, Contributor) to any principal at workspace {target.name}'s scope (Microsoft.Authorization/roleAssignments/write), including itself.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-role-assignment-write
emits: CanGrantPermission
description: Owner / User Access Administrator on the AML workspace or compute scope can grant AML roles
to any principal, including itself.
match_effective_permission:
action: Microsoft.Authorization/roleAssignments/write
scope_type: resource|resourceGroup|subscription
where:
- scope covers the AML workspace or its parent resource group / subscription
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <any principal>
permissions:
- Microsoft.Authorization/roleAssignments/write
conditions:
- iam_permission
false_positive_note: Only Owner and User Access Administrator (or custom roles with Microsoft.Authorization/roleAssignments/write)
can grant roles. Contributor does NOT include this action. Scoping conditions may restrict which roles
can be assigned (e.g. conditions on roleDefinitionId). Honor deny assignments that block role-assignment
write.
narrative: '{principal.name} can grant AML roles (e.g. AzureML Data Scientist, Contributor) to any principal
at workspace {target.name}''s scope (Microsoft.Authorization/roleAssignments/write), including itself.'