azure-dbx-cluster-policy-write

id: azure-dbx-cluster-policy-write
emits: CanModifyConfiguration
description: Cluster policy write/admin allows loosening security constraints on cluster creation (init
  scripts, credential passthrough, unconstrained Spark conf).
match_effective_permission:
  action: databricks:cluster-policies:write
  scope_type: workspace
where:
- principal has Databricks workspace Admin role OR can call POST /api/2.0/policies/clusters/create and
  PATCH /api/2.0/policies/clusters/edit
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Databricks Workspace (AnalyticsService)>
  permissions:
  - databricks:cluster-policies:write (workspace Admin or cluster policy admin entitlement)
  conditions:
  - service_state
  escalation: "Modify or create a cluster policy that permits init scripts, relaxes Spark conf constraints,\
    \ or enables credential passthrough, then create a cluster with the loosened policy. Effective escalation\
    \ path: policy write \u2192 cluster create \u2192 init script or MI binding \u2192 CanExecuteAs."
  false_positive_note: Policy write alone does not yield code execution; it enables downstream cluster
    create actions that were previously blocked. Emit CONDITIONAL unless the caller can also create/edit
    a cluster under the new policy. Cluster policies are a Databricks data-plane (REST API) concept; they
    are not exposed as ARM sub-resources.
  narrative: '{principal.name} can write cluster policies for workspace {target.name} (Databricks workspace
    Admin or cluster policy admin), potentially loosening init-script or Spark-conf constraints to enable
    otherwise-blocked code injection paths.'