azure-batch-submit-task
Submit a job/task whose commandLine runs on pool nodes.
match (effective permission)
{
"action": "Microsoft.Batch/batchAccounts/jobs/write",
"data_action": true,
"scope_type": "resource|resourceGroup|subscription"
}
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanReadSecret <Batch account shared keys>
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <batch pool (ContainerCluster)> |
| permissions | Microsoft.Batch/batchAccounts/jobs/write |
| conditions | service_state |
| state logic | ACTIVE via the jobs/write DATA action OR via a held shared key (optional[0]); else do not emit |
Narrative
{principal.name} can submit a task to pool {target.name} (jobs/write data action or shared key), executing its commandLine on the nodes.
Raw rule rules/derived/azure/batch.yaml
id: azure-batch-submit-task
emits: CanExecuteCommand
description: Submit a job/task whose commandLine runs on pool nodes.
match_effective_permission:
action: Microsoft.Batch/batchAccounts/jobs/write
data_action: true
scope_type: resource|resourceGroup|subscription
optional:
- - principal: null
- CanReadSecret
- <Batch account shared keys>
emit:
source_type: Identity
source: <principal>
target: <batch pool (ContainerCluster)>
permissions:
- Microsoft.Batch/batchAccounts/jobs/write
conditions:
- service_state
state_logic: ACTIVE via the jobs/write DATA action OR via a held shared key (optional[0]); else do not
emit
false_positive_note: jobs/write is a DATA action - a narrow custom role with management actions only
does NOT grant it. Either the data action OR possession of a shared key (listkeys/regeneratekeys)
is required to submit a task. Emitted as CanExecuteCommand (not CanInvoke) because the pool is a ContainerCluster,
which is outside the CanInvoke target set [ServerlessFunction, API, APIGateway, Workflow]; task submission
runs an attacker-chosen commandLine on the pool nodes, which is the CanExecuteCommand semantic.
narrative: '{principal.name} can submit a task to pool {target.name} (jobs/write data action or shared
key), executing its commandLine on the nodes.'