rage.fail

azure-dbx-workspace-contains-secret-scope

explicit azure emits Contains

match (record)

{ "field": "name", "resource_type": "Databricks::SecretScope" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<Databricks workspace node>`
target	`<secret scope node (Secret)>`

Narrative

Databricks workspace {workspace.name} contains secret scope {scope.name}.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-workspace-contains-secret-scope
emits: Contains
applies_to:
- azure
match_record:
  resource_type: Databricks::SecretScope
  field: name
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <Databricks workspace node>
  target: <secret scope node (Secret)>
  api_source: GET /api/2.0/secret/scopes/list
  evidence_field: name
  narrative: Databricks workspace {workspace.name} contains secret scope {scope.name}.