azure-dbx-public-rest-endpoint

id: azure-dbx-public-rest-endpoint
emits: ExposedToInternet
description: Databricks workspace REST API endpoint is publicly reachable; any token/PAT holder can authenticate
  from the internet.
match_effective_permission:
  config_property: publicNetworkAccess
  value: enabled|null
where:
- workspace publicNetworkAccess != Disabled
- workspace does not enforce Private Link for both front-end and back-end (privateEndpoint count < 2 OR
  requiredNsgRules != AllRules)
emit:
  source_type: AnalyticsService
  target_type: AnonymousIdentity
  source: <Databricks workspace (AnalyticsService)>
  target: <AnonymousIdentity>
  conditions:
  - network_reachability
  false_positive_note: "The workspace REST API endpoint (adb-<id>.azuredatabricks.net) is public by default.\
    \ With Private Link enforced (publicNetworkAccess = Disabled + private endpoints for both front-end\
    \ browser and back-end cluster-to-control-plane), the endpoint is no longer internet-accessible ->\
    \ do NOT emit ExposedToInternet; emit PrivateReachability instead. Note: even with No-Public-IP (NPIP/secure\
    \ cluster connectivity), the CONTROL PLANE endpoint remains public \u2014 NPIP only removes public\
    \ IPs from cluster nodes; the workspace URL stays public."
  narrative: Databricks workspace {source.name} REST API (adb-<id>.azuredatabricks.net) is reachable from
    the internet; any PAT or Azure AD token holder can authenticate to the API without being on a private
    network.