rage.fail

azure-aml-workspace-in-subscription

explicit azure emits LocatedIn

match (record)

{ "field": "id", "resource_type": "Microsoft.MachineLearningServices/workspaces" }

emit

source type	`AnalyticsService`
target type	`Subscription`
source	`<AML workspace>`
target	`<Azure subscription (parsed from ARM resource ID)>`

Narrative

AML workspace {workspace.name} is located in subscription {subscription.id}.

Raw rule rules/explicit/azure-machinelearning.yaml

id: azure-aml-workspace-in-subscription
emits: LocatedIn
applies_to:
- azure
match_record:
  resource_type: Microsoft.MachineLearningServices/workspaces
  field: id
emit:
  source_type: AnalyticsService
  target_type: Subscription
  source: <AML workspace>
  target: <Azure subscription (parsed from ARM resource ID)>
  api_source: GET /subscriptions/{sub}/providers/Microsoft.MachineLearningServices/workspaces
  evidence_field: id (subscriptionId segment of ARM resource ID)
  narrative: AML workspace {workspace.name} is located in subscription {subscription.id}.