rage.fail

azure-dbx-secret-scope-kv-backed

explicit azure emits ContainsSecret

match (record)

{ "field": "backend_type", "resource_type": "Databricks::SecretScope" }

where

backend_type == AZURE_KEYVAULT keyvault_metadata.dns_name and resource_id are set

emit

source type	`Storage`
target type	`Secret`
source	`<Databricks secret scope node (Secret/Databricks-KV-backed)>`
target	`<Azure Key Vault referenced (Secret/KeyVaultVault)>`

Narrative

Databricks secret scope {scope.name} is backed by Azure Key Vault {kv.name}; reads are proxied through the Access Connector MI.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-secret-scope-kv-backed
emits: ContainsSecret
applies_to:
- azure
match_record:
  resource_type: Databricks::SecretScope
  field: backend_type
where:
- backend_type == AZURE_KEYVAULT
- keyvault_metadata.dns_name and resource_id are set
emit:
  source_type: Storage
  target_type: Secret
  source: <Databricks secret scope node (Secret/Databricks-KV-backed)>
  target: <Azure Key Vault referenced (Secret/KeyVaultVault)>
  api_source: GET /api/2.0/secret/scopes/list
  evidence_field: backend_azure_keyvault.dns_name
  note: A KV-backed scope proxies reads to the Azure Key Vault via the Access Connector MI. The MI must
    have Key Vault Secret Get permission for the scope reads to succeed. Recording the ContainsSecret
    link enables credential-chains to reason about the Key Vault as the ultimate secret store and the
    MI as the required decryptor.
  narrative: Databricks secret scope {scope.name} is backed by Azure Key Vault {kv.name}; reads are proxied
    through the Access Connector MI.