rage.fail

azure-dbx-job-executes-as-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "settings.job_clusters OR settings.tasks[].existing_cluster_id", "resource_type": "Databricks::Job" }

where

job uses a new_cluster (settings.job_clusters[].new_cluster) or an existing cluster with a bound MI the cluster (new or existing) has an Access Connector MI or cluster-level MI (resolved via azure-dbx-cluster-executes-as-* rules)

emit

source type	`BatchJob`
target type	`ManagedIdentity`
source	`<job node (BatchJob)>`
target	`<MI of the job cluster (ManagedIdentity)>`

Narrative

Databricks job {job.name} executes as MI {mi.name} via its cluster.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-job-executes-as-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Databricks::Job
  field: settings.job_clusters OR settings.tasks[].existing_cluster_id
where:
- job uses a new_cluster (settings.job_clusters[].new_cluster) or an existing cluster with a bound MI
- the cluster (new or existing) has an Access Connector MI or cluster-level MI (resolved via azure-dbx-cluster-executes-as-*
  rules)
emit:
  source_type: BatchJob
  target_type: ManagedIdentity
  source: <job node (BatchJob)>
  target: <MI of the job cluster (ManagedIdentity)>
  api_source: GET /api/2.1/jobs/list + cluster MI resolution
  evidence_field: settings.job_clusters[].new_cluster or tasks[].existing_cluster_id
  note: A Databricks job inherits the MI of its compute cluster. For new_cluster, resolve the MI from
    the cluster spec's azure_attributes. For existing_cluster_id, look up the cluster's MI from the cluster-level
    ExecutesAs edges. Emit for each MI-bearing cluster reference in the job.
  narrative: Databricks job {job.name} executes as MI {mi.name} via its cluster.