azure-batch-submit-task

Submit a job/task whose commandLine runs on pool nodes.

derived azure emits CanExecuteCommand

match (effective permission)

{ "action": "Microsoft.Batch/batchAccounts/jobs/write", "data_action": true, "scope_type": "resource|resourceGroup|subscription" }

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanReadSecret <Batch account shared keys>

emit

source typeIdentity
source<principal>
target<batch pool (ContainerCluster)>
permissionsMicrosoft.Batch/batchAccounts/jobs/write
conditionsservice_state
state logicACTIVE via the jobs/write DATA action OR via a held shared key (optional[0]); else do not emit

Narrative

{principal.name} can submit a task to pool {target.name} (jobs/write data action or shared key), executing its commandLine on the nodes.

Raw rule rules/derived/azure/batch.yaml

id: azure-batch-submit-task
emits: CanExecuteCommand
description: Submit a job/task whose commandLine runs on pool nodes.
match_effective_permission:
  action: Microsoft.Batch/batchAccounts/jobs/write
  data_action: true
  scope_type: resource|resourceGroup|subscription
optional:
- - principal: null
  - CanReadSecret
  - <Batch account shared keys>
emit:
  source_type: Identity
  source: <principal>
  target: <batch pool (ContainerCluster)>
  permissions:
  - Microsoft.Batch/batchAccounts/jobs/write
  conditions:
  - service_state
  state_logic: ACTIVE via the jobs/write DATA action OR via a held shared key (optional[0]); else do not
    emit
  false_positive_note: jobs/write is a DATA action - a narrow custom role with management actions only
    does NOT grant it. Either the data action OR possession of a shared key (listkeys/regeneratekeys)
    is required to submit a task. Emitted as CanExecuteCommand (not CanInvoke) because the pool is a ContainerCluster,
    which is outside the CanInvoke target set [ServerlessFunction, API, APIGateway, Workflow]; task submission
    runs an attacker-chosen commandLine on the pool nodes, which is the CanExecuteCommand semantic.
  narrative: '{principal.name} can submit a task to pool {target.name} (jobs/write data action or shared
    key), executing its commandLine on the nodes.'
move · open · esc close