rage.fail

azure-dbx-cluster-spark-conf-contains-key

explicit azure emits ContainsSecret

match (record)

{ "field": "spark_conf", "resource_type": "Databricks::Cluster" }

where

spark_conf has a key matching spark.hadoop.fs.azure.account.key.*, fs.azure.sas.*, spark.hadoop.fs.azure.account.oauth2.*, or similar credential patterns the value is a non-empty string (not a Key Vault reference like {{secrets/<scope>/<key>}})

emit

source type	`GenericCompute`
target type	`Secret`
source	`<cluster node (BatchJob/GenericCompute)>`
target	`<embedded storage credential (Credential/AccessKey)>`

Narrative

Cluster {cluster.name} contains a storage credential in spark_conf ({spark_conf_key}); readable via GET /api/2.0/clusters/get.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-cluster-spark-conf-contains-key
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Databricks::Cluster
  field: spark_conf
where:
- spark_conf has a key matching spark.hadoop.fs.azure.account.key.*, fs.azure.sas.*, spark.hadoop.fs.azure.account.oauth2.*,
  or similar credential patterns
- the value is a non-empty string (not a Key Vault reference like {{secrets/<scope>/<key>}})
emit:
  source_type: GenericCompute
  target_type: Secret
  source: <cluster node (BatchJob/GenericCompute)>
  target: <embedded storage credential (Credential/AccessKey)>
  api_source: GET /api/2.0/clusters/list
  evidence_field: spark_conf[spark.hadoop.fs.azure.account.key.*]
  note: "Inline credentials in Spark config are returned in the clusters/list response body (readable\
    \ by any cluster viewer). Key Vault references using the {{secrets/<scope>/<key>}} interpolation syntax\
    \ are NOT inline credentials \u2014 the actual value is in the secret scope, not the Spark config."
  narrative: Cluster {cluster.name} contains a storage credential in spark_conf ({spark_conf_key}); readable
    via GET /api/2.0/clusters/get.