rage.fail

azure-dbx-workspace-contains-pat

explicit azure emits ContainsCredential

match (record)

{ "api": "GET /api/2.0/token-management/tokens", "resource_type": "Databricks::Workspace" }

where

response includes active PAT records (admin listing — requires workspace Admin) token_info[].expiry_time is in the future or -1 (non-expiring)

emit

source type	`AnalyticsService`
target type	`Credential`
source	`<Databricks workspace node>`
target	`<PAT token (Token)>`

Narrative

Databricks workspace {workspace.name} has active PAT tokens ({count} tokens); these authenticate to the workspace REST API as their issuing users.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-workspace-contains-pat
emits: ContainsCredential
applies_to:
- azure
match_record:
  resource_type: Databricks::Workspace
  api: GET /api/2.0/token-management/tokens
where:
- "response includes active PAT records (admin listing \u2014 requires workspace Admin)"
- token_info[].expiry_time is in the future or -1 (non-expiring)
emit:
  source_type: AnalyticsService
  target_type: Credential
  source: <Databricks workspace node>
  target: <PAT token (Token)>
  api_source: GET /api/2.0/token-management/tokens (workspace Admin)
  evidence_field: token_info[].token_id
  note: PAT tokens authenticate to the Databricks REST API as the issuing user. The token VALUE is not
    returned by the list API (only the token_id and metadata); the existence fact is still security-relevant
    (shows persistent credential material). A workspace Admin can create tokens for other users (CanCreateCredentialFor)
    and revoke all tokens.
  narrative: Databricks workspace {workspace.name} has active PAT tokens ({count} tokens); these authenticate
    to the workspace REST API as their issuing users.