azure-purview-data-curator-role-assignment
A principal is assigned the Purview Data Curator role within a Purview account. Data Curator allows read and write access to catalog assets, classifications, and glossary terms (data-plane write access).
where
role.name == 'Data Curator'
principalId is non-null
policyElements.purviewAccountId is non-null
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <Identity node for the principal> |
| target | <Role node representing 'Purview Data Curator' scoped to {purviewAccountId}> |
| state logic | ACTIVE when the account is provisioned and role assignment confirmed. |
Narrative
{principal.name} holds the Purview Data Curator role on Purview account {account.name}.
Raw rule rules/explicit/azure/purview.yaml
id: azure-purview-data-curator-role-assignment
emits: HasRole
description: A principal is assigned the Purview Data Curator role within a Purview account. Data Curator
allows read and write access to catalog assets, classifications, and glossary terms (data-plane write
access).
applies_to:
- azure
source_config:
collector: purview-policyElements-api
api_endpoint: '{purviewEndpoint}/catalog/api/policyElements'
field: roles
where:
- role.name == 'Data Curator'
- principalId is non-null
- policyElements.purviewAccountId is non-null
emit:
source_type: Identity
target_type: Role
source: <Identity node for the principal>
target: <Role node representing 'Purview Data Curator' scoped to {purviewAccountId}>
api_source: Purview policyElements API
evidence_field: roles[].name, principalId, accountId
state_logic: ACTIVE when the account is provisioned and role assignment confirmed.
narrative: '{principal.name} holds the Purview Data Curator role on Purview account {account.name}.'
derived_from: []