azure-dbx-admin-pat-mint
match (effective permission)
{
"action": "databricks:token-management:create",
"scope_type": "workspace"
}
where
principal is a Databricks workspace Admin (POST /api/2.0/token-management/tokens with user_id)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <Databricks Admin principal> |
| target | <any Databricks workspace user (HumanIdentity/MachineIdentity)> |
| permissions | databricks:token-management:create (workspace Admin — POST /api/2.0/token-management/tokens) |
Narrative
{principal.name} is a Databricks workspace Admin and can create a PAT for any user (POST /api/2.0/token-management/tokens), yielding a long-lived token that impersonates that user in the workspace REST API.
Raw rule rules/explicit/azure-databricks.yaml
id: azure-dbx-admin-pat-mint
emits: CanCreateCredentialFor
applies_to:
- azure
match_effective_permission:
action: databricks:token-management:create
scope_type: workspace
where:
- principal is a Databricks workspace Admin (POST /api/2.0/token-management/tokens with user_id)
emit:
source_type: Identity
target_type: Identity
source: <Databricks Admin principal>
target: <any Databricks workspace user (HumanIdentity/MachineIdentity)>
permissions:
- "databricks:token-management:create (workspace Admin \u2014 POST /api/2.0/token-management/tokens)"
api_source: Databricks SCIM / workspace role list
evidence_field: workspace_admin_role assignment
note: This is an explicit normalization rule that reads the workspace Admin role assignment data to
emit CanCreateCredentialFor. Admin role status is an explicit permission fact (not derived).
false_positive_note: Only workspace Admins can create tokens for OTHER users via the token-management
API. Regular users can only create tokens for themselves (POST /api/2.0/token/create). Admin token
creation for another user yields a PAT that authenticates as that user to the Databricks REST API
-> full impersonation of the target user's workspace permissions. The minted PAT is a long-lived credential.
narrative: '{principal.name} is a Databricks workspace Admin and can create a PAT for any user (POST
/api/2.0/token-management/tokens), yielding a long-lived token that impersonates that user in the
workspace REST API.'