rage.fail

azure-dbx-cluster-executes-as-cluster-level-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "azure_attributes.msi_resource_id", "resource_type": "Databricks::Cluster" }

where

cluster spark_conf has spark.databricks.azure.msi.enabled = true azure_attributes.msi_resource_id is set to a user-assigned MI resource id

emit

source type	`GenericCompute`
target type	`ManagedIdentity`
source	`<cluster node (BatchJob/GenericCompute)>`
target	`<user-assigned MI (ManagedIdentity)>`

Narrative

Cluster {cluster.name} executes as user-assigned MI {mi.name} (cluster-level Azure MI auth mode, IMDS at 169.254.169.254).

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-cluster-executes-as-cluster-level-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Databricks::Cluster
  field: azure_attributes.msi_resource_id
where:
- cluster spark_conf has spark.databricks.azure.msi.enabled = true
- azure_attributes.msi_resource_id is set to a user-assigned MI resource id
emit:
  source_type: GenericCompute
  target_type: ManagedIdentity
  source: <cluster node (BatchJob/GenericCompute)>
  target: <user-assigned MI (ManagedIdentity)>
  api_source: GET /api/2.0/clusters/list
  evidence_field: azure_attributes.msi_resource_id
  note: 'Cluster-level user-assigned MI (Azure MI auth mode): the cluster nodes expose this MI via IMDS
    (169.254.169.254). Only valid when spark.databricks.azure.msi.enabled is true and the cluster profile
    permits it (singleUser or compatible profile).'
  narrative: Cluster {cluster.name} executes as user-assigned MI {mi.name} (cluster-level Azure MI auth
    mode, IMDS at 169.254.169.254).