azure-synapse-ir-listkeys
integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can register a self-hosted IR node, giving that node persistent pipeline-execution foothold.
match (effective permission)
{
"any_of": [
{
"action": "Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action",
"scope_type": "resource|resourceGroup|subscription"
},
{
"action": "Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action",
"scope_type": "resource|resourceGroup|subscription"
}
]
}
emit
| source type | Identity |
|---|---|
| target type | Secret |
| source | <principal> |
| target | <integration runtime auth key (Credential)> |
| permissions | Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action |
| state logic | ACTIVE via listAuthKeys/action OR regenerateAuthKey/action alone; regenerateAuthKey returns the newly regenerated key value. |
Narrative
{principal.name} can retrieve integration runtime auth keys from Synapse workspace (listAuthKeys/action or regenerateAuthKey/action), enabling registration of a persistent self-hosted IR node.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-ir-listkeys
emits: CanReadSecret
description: integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can
register a self-hosted IR node, giving that node persistent pipeline-execution foothold.
match_effective_permission:
any_of:
- action: Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action
scope_type: resource|resourceGroup|subscription
- action: Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Secret
source: <principal>
target: <integration runtime auth key (Credential)>
permissions:
- Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action
- Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action
state_logic: ACTIVE via listAuthKeys/action OR regenerateAuthKey/action alone; regenerateAuthKey returns
the newly regenerated key value.
false_positive_note: "IR auth keys register self-hosted IR nodes \u2014 a node registered with these\
\ keys executes pipeline activities in its context. This is a durable persistence mechanism. regenerateAuthKey\
\ rotates the key and returns the new value; a principal with only regenerateAuthKey (no listAuthKeys)\
\ still obtains a usable key. Only relevant for workspaces that have self-hosted integration runtimes\
\ (not the Azure-hosted AutoResolveIntegrationRuntime)."
narrative: '{principal.name} can retrieve integration runtime auth keys from Synapse workspace (listAuthKeys/action
or regenerateAuthKey/action), enabling registration of a persistent self-hosted IR node.'