rage.fail

azure-synapse-create-trigger

Synapse Artifact Publisher role allows creating schedule/event/tumbling-window triggers that repeatedly run pipelines - persistence mechanism for code execution as the workspace MI.

derived azure emits CanSchedule

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasRole <Synapse Artifact Publisher role on workspace>

where

Synapse RBAC role: Synapse Artifact Publisher at workspace scope

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Synapse workspace (Scheduler)>`
permissions	`Synapse RBAC: Synapse Artifact Publisher`
conditions	`trigger_exists` `service_state`

Narrative

{principal.name} has Synapse Artifact Publisher; can create recurring schedule/event triggers in Synapse workspace {target.name}, establishing persistent pipeline execution as the workspace MI.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-create-trigger
emits: CanSchedule
description: "Synapse Artifact Publisher role allows creating schedule/event/tumbling-window triggers\
  \ that repeatedly run pipelines \u2014 persistence mechanism for code execution as the workspace MI."
match:
- - principal: null
  - HasRole
  - <Synapse Artifact Publisher role on workspace>
where:
- 'Synapse RBAC role: Synapse Artifact Publisher at workspace scope'
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Synapse workspace (Scheduler)>
  permissions:
  - 'Synapse RBAC: Synapse Artifact Publisher'
  conditions:
  - trigger_exists
  - service_state
  false_positive_note: "CanSchedule is a persistence/trigger-creation edge. The pipeline the trigger invokes\
    \ must exist and be published; CanSchedule alone does not create code execution \u2014 it arms a trigger\
    \ that feeds into CanTrigger -> CanExecuteAs (via cicd-chains). Emit CONDITIONAL(trigger_exists) if\
    \ no pipeline is yet published."
  narrative: '{principal.name} has Synapse Artifact Publisher; can create recurring schedule/event triggers
    in Synapse workspace {target.name}, establishing persistent pipeline execution as the workspace MI.'