rage.fail

azure-dbx-sql-warehouse-executes-as-mi

explicit azure emits ExecutesAs

match (record)

{ "field": "warehouse_type|cluster_size", "resource_type": "Databricks::SQLWarehouse" }

where

SQL Warehouse is created in a workspace with an Access Connector MI (the workspace default execution identity) the workspace has configured an Access Connector or cluster-level MI for SQL query execution

emit

source type	`DataWarehouse`
target type	`ManagedIdentity`
source	`<SQL Warehouse node (DataWarehouse)>`
target	`<MI of the workspace Access Connector (ManagedIdentity)>`

Narrative

SQL Warehouse {source.name} executes queries as MI {target.name} via the workspace Access Connector, enabling IMDS-based Azure resource access for SQL query workloads.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-sql-warehouse-executes-as-mi
emits: ExecutesAs
applies_to:
- azure
match_record:
  resource_type: Databricks::SQLWarehouse
  field: warehouse_type|cluster_size
where:
- SQL Warehouse is created in a workspace with an Access Connector MI (the workspace default execution
  identity)
- the workspace has configured an Access Connector or cluster-level MI for SQL query execution
emit:
  source_type: DataWarehouse
  target_type: ManagedIdentity
  source: <SQL Warehouse node (DataWarehouse)>
  target: <MI of the workspace Access Connector (ManagedIdentity)>
  api_source: GET /api/2.0/sql/warehouses + workspace Access Connector resolution
  evidence_field: warehouse_id from /api/2.0/sql/warehouses
  note: Databricks SQL Warehouses execute queries using the workspace's configured Access Connector MI.
    Unlike clusters, SQL Warehouse execution identity is not independently configurable per warehouse;
    it is a workspace-level setting. Any SQL queries executed on the warehouse run as the workspace's
    Access Connector MI.
  narrative: SQL Warehouse {source.name} executes queries as MI {target.name} via the workspace Access
    Connector, enabling IMDS-based Azure resource access for SQL query workloads.