azure-dbx-cluster-create-edit
Cluster create/edit permission allows modifying Spark configuration (MI binding, credential passthrough, init scripts).
match (effective permission)
{
"any_of": [
{
"action": "databricks:clusters:create",
"scope_type": "workspace"
},
{
"action": "databricks:clusters:edit",
"scope_type": "cluster"
}
]
}
where
principal has Databricks cluster create permission (governed by cluster policy) OR CAN_MANAGE on an existing cluster
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Databricks Cluster (BatchJob/GenericCompute)> |
| permissions | databricks:clusters:create (cluster policy allows) OR databricks:clusters:edit (CAN_MANAGE on cluster — POST /api/2.0/clusters/edit) |
| conditions | role_compatibility service_state |
Narrative
{principal.name} can create or edit cluster {target.name} configuration (cluster create policy / CAN_MANAGE), modifying its MI binding, Spark conf, or init scripts.
Raw rule rules/derived/azure/databricks.yaml
id: azure-dbx-cluster-create-edit
emits: CanModifyConfiguration
description: Cluster create/edit permission allows modifying Spark configuration (MI binding, credential
passthrough, init scripts).
match_effective_permission:
any_of:
- action: databricks:clusters:create
scope_type: workspace
- action: databricks:clusters:edit
scope_type: cluster
where:
- principal has Databricks cluster create permission (governed by cluster policy) OR CAN_MANAGE on an
existing cluster
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Databricks Cluster (BatchJob/GenericCompute)>
permissions:
- "databricks:clusters:create (cluster policy allows) OR databricks:clusters:edit (CAN_MANAGE on cluster\
\ \u2014 POST /api/2.0/clusters/edit)"
conditions:
- role_compatibility
- service_state
escalation: Modify Spark configuration (spark.databricks.azure.msi.enabled, msi_resource_id, init_scripts,
spark.hadoop.fs.azure.account.key.*) or change the attached Access Connector to one with a more privileged
MI. Realized at cluster restart.
false_positive_note: Cluster create is gated by cluster policy; a restrictive policy may block init
scripts or unconstrained Spark conf -> CONDITIONAL(role_compatibility). Config change realized only
after cluster restart -> CONDITIONAL(service_state) on a running cluster. The cluster create/edit
does NOT by itself bypass cluster policy on managed clusters.
narrative: '{principal.name} can create or edit cluster {target.name} configuration (cluster create
policy / CAN_MANAGE), modifying its MI binding, Spark conf, or init scripts.'