azure-synapse-bigdatapool-write-library

id: azure-synapse-bigdatapool-write-library
emits: CanModifyCode
description: bigDataPools/write allows uploading custom library packages to a Spark pool; those libraries
  execute on Spark workers running as the workspace MI.
match_effective_permission:
  action: Microsoft.Synapse/workspaces/bigDataPools/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Spark pool (bigDataPool)>
  permissions:
  - Microsoft.Synapse/workspaces/bigDataPools/write
  conditions:
  - service_state
  state_logic: "ACTIVE when the Spark pool exists and a Spark session/job will run; if the pool is new\
    \ or currently idle with no scheduled jobs, CONDITIONAL(trigger_exists) \u2014 the library injection\
    \ is planted but requires a subsequent job submission to execute. The library code runs as soon as\
    \ a Spark session starts on the pool."
  false_positive_note: "Library upload executes only when a Spark job or notebook is submitted to the\
    \ pool; do not emit ACTIVE if no run path exists (no scheduled sessions, no users submitting interactively).\
    \ bigDataPools/write alone does NOT submit jobs \u2014 a Synapse Compute Operator or interactive user\
    \ must still trigger the session. Pair with a trigger path (Synapse Compute Operator, scheduler) for\
    \ ACTIVE."
  narrative: '{principal.name} can upload a malicious custom library to Spark pool {target.name} (Microsoft.Synapse/workspaces/bigDataPools/write);
    the library executes on Spark workers on the next job run.'