rage.fail

azure-dbx-cluster-init-script-uri

explicit azure emits ContainsResourceReference

match (record)

{ "field": "init_scripts", "resource_type": "Databricks::Cluster" }

where

init_scripts is non-empty (contains workspace, dbfs, abfss, s3, file, or gcs URIs)

emit

source type	`GenericCompute`
target type	`*`
source	`<cluster node>`
target	`<init-script storage resource (ObjectStorage/FileStorage)>`

Narrative

Cluster {cluster.name} references init script at {init_script_uri}; write access to that URI + cluster edit enables code injection.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-cluster-init-script-uri
emits: ContainsResourceReference
applies_to:
- azure
match_record:
  resource_type: Databricks::Cluster
  field: init_scripts
where:
- init_scripts is non-empty (contains workspace, dbfs, abfss, s3, file, or gcs URIs)
emit:
  source_type: GenericCompute
  target_type: '*'
  source: <cluster node>
  target: <init-script storage resource (ObjectStorage/FileStorage)>
  api_source: GET /api/2.0/clusters/list
  evidence_field: init_scripts[].dbfs OR .abfss OR .workspace
  note: "Init scripts run as root before user code on each node start. The reference URI points to a storage\
    \ location (ADLS Gen2 abfss://, DBFS, workspace files). Whoever can write to that URI AND set it as\
    \ an init_scripts entry (cluster edit) can inject code \u2014 captured by azure-dbx-cluster-init-script\
    \ in the derived rules."
  narrative: Cluster {cluster.name} references init script at {init_script_uri}; write access to that
    URI + cluster edit enables code injection.