rage.fail

azure-dbx-cluster-executes-as-access-connector-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "azure_attributes.access_connector_id", "resource_type": "Databricks::Cluster" }

where

cluster azure_attributes.access_connector_id is set the referenced Access Connector (Microsoft.Databricks/accessConnectors) has identity.userAssignedIdentities or systemAssigned MI

emit

source type	`GenericCompute`
target type	`ManagedIdentity`
source	`<cluster node (BatchJob/GenericCompute)>`
target	`<MI on the referenced Access Connector (ManagedIdentity)>`

Narrative

Cluster {cluster.name} executes as managed identity {mi.name} via Access Connector {connector.name}.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-cluster-executes-as-access-connector-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Databricks::Cluster
  field: azure_attributes.access_connector_id
where:
- cluster azure_attributes.access_connector_id is set
- the referenced Access Connector (Microsoft.Databricks/accessConnectors) has identity.userAssignedIdentities
  or systemAssigned MI
emit:
  source_type: GenericCompute
  target_type: ManagedIdentity
  source: <cluster node (BatchJob/GenericCompute)>
  target: <MI on the referenced Access Connector (ManagedIdentity)>
  api_source: GET /api/2.0/clusters/list + az databricks access-connector show
  evidence_field: azure_attributes.access_connector_id -> accessConnectors identity
  note: The Access Connector MI is the canonical execution identity for clusters configured with Unity
    Catalog or credential passthrough. The MI resource is resolved from the accessConnectors ARM resource
    identity block (system-assigned principalId or userAssignedIdentities keys). Every cluster using this
    connector inherits the MI.
  narrative: Cluster {cluster.name} executes as managed identity {mi.name} via Access Connector {connector.name}.