rage.fail

azure-dbx-pipeline-executes-as-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "spec.clusters OR cluster", "resource_type": "Databricks::Pipeline" }

where

DLT pipeline has a cluster configuration referencing an Access Connector MI or cluster-level MI

emit

source type	`BatchJob`
target type	`ManagedIdentity`
source	`<DLT pipeline node (BatchJob)>`
target	`<MI of the pipeline cluster (ManagedIdentity)>`

Narrative

DLT pipeline {pipeline.name} executes as MI {mi.name} via its cluster.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-pipeline-executes-as-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Databricks::Pipeline
  field: spec.clusters OR cluster
where:
- DLT pipeline has a cluster configuration referencing an Access Connector MI or cluster-level MI
emit:
  source_type: BatchJob
  target_type: ManagedIdentity
  source: <DLT pipeline node (BatchJob)>
  target: <MI of the pipeline cluster (ManagedIdentity)>
  api_source: GET /api/2.0/pipelines + cluster MI resolution
  evidence_field: spec.clusters[].azure_attributes.access_connector_id
  narrative: DLT pipeline {pipeline.name} executes as MI {mi.name} via its cluster.