azure-synapse-create-workload-as-via-attach-mi

Attach a privileged user-assigned MI to the workspace (CanAttachIdentity) + workspace gains a new ExecutesAs target -> all Spark/pipeline runs can mint tokens for the attached MI.

derived azure emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<user-assigned managed identity>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.Synapse/workspaces/write`
conditions	`role_compatibility` `service_state`

source type

Identity

target type

Identity

source

<principal>

target

<user-assigned managed identity>

permissions

Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.Synapse/workspaces/write

conditions

role_compatibility service_state

Narrative

{principal.name} can attach user-assigned MI {userMI.name} to Synapse workspace {workspace.name}; all subsequent Spark jobs and pipeline runs mint tokens for {userMI.name}, effectively creating workloads running as that higher-privilege identity.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-create-workload-as-via-attach-mi
emits: CanCreateWorkloadAs
description: Attach a privileged user-assigned MI to the workspace (CanAttachIdentity) + workspace gains
  a new ExecutesAs target -> all Spark/pipeline runs can mint tokens for the attached MI.
match:
- - principal: null
  - CanAttachIdentity
  - workspace: null
- - principal: null
  - CanPassIdentity
  - userMI: null
where:
- 'node_type(?workspace) == AnalyticsService  # Synapse workspace'
- node_type(?userMI) == ManagedIdentity
- ?userMI.privilege_level >= ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <user-assigned managed identity>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.Synapse/workspaces/write
  conditions:
  - role_compatibility
  - service_state
  derived_from:
  - <CanAttachIdentity edge_id>
  note: CITES can-execute-as.yaml execute-as-via-new-workload for the CanExecuteAs roll-up off this CanCreateWorkloadAs
    edge. The workspace becomes a "new workload" running as the privileged MI after the attachment. The
    second match clause [ ?principal, CanPassIdentity, ?userMI ] binds the user-assigned MI; this prerequisite
    is already required by azure-synapse-attach-user-mi rule 5.
  false_positive_note: "Requires assign/action on the user-assigned MI AND workspaces/write \u2014 both\
    \ are required (azure-synapse-attach-user-mi). The new MI becomes an ExecutesAs target on the NEXT\
    \ session start (not retroactive). Honor the assign/action resource scope. Escalation only when the\
    \ attached MI out-privileges the principal."
  narrative: '{principal.name} can attach user-assigned MI {userMI.name} to Synapse workspace {workspace.name};
    all subsequent Spark jobs and pipeline runs mint tokens for {userMI.name}, effectively creating workloads
    running as that higher-privilege identity.'