azure-synapse-ir-listkeys

integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can register a self-hosted IR node, giving that node persistent pipeline-execution foothold.

derived azure emits CanReadSecret

match (effective permission)

{ "any_of": [ { "action": "Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action", "scope_type": "resource|resourceGroup|subscription" }, { "action": "Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action", "scope_type": "resource|resourceGroup|subscription" } ] }

emit

source typeIdentity
target typeSecret
source<principal>
target<integration runtime auth key (Credential)>
permissionsMicrosoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action
state logicACTIVE via listAuthKeys/action OR regenerateAuthKey/action alone; regenerateAuthKey returns the newly regenerated key value.

Narrative

{principal.name} can retrieve integration runtime auth keys from Synapse workspace (listAuthKeys/action or regenerateAuthKey/action), enabling registration of a persistent self-hosted IR node.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-ir-listkeys
emits: CanReadSecret
description: integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can
  register a self-hosted IR node, giving that node persistent pipeline-execution foothold.
match_effective_permission:
  any_of:
  - action: Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action
    scope_type: resource|resourceGroup|subscription
  - action: Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action
    scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Secret
  source: <principal>
  target: <integration runtime auth key (Credential)>
  permissions:
  - Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys/action
  - Microsoft.Synapse/workspaces/integrationRuntimes/regenerateAuthKey/action
  state_logic: ACTIVE via listAuthKeys/action OR regenerateAuthKey/action alone; regenerateAuthKey returns
    the newly regenerated key value.
  false_positive_note: "IR auth keys register self-hosted IR nodes \u2014 a node registered with these\
    \ keys executes pipeline activities in its context. This is a durable persistence mechanism. regenerateAuthKey\
    \ rotates the key and returns the new value; a principal with only regenerateAuthKey (no listAuthKeys)\
    \ still obtains a usable key. Only relevant for workspaces that have self-hosted integration runtimes\
    \ (not the Azure-hosted AutoResolveIntegrationRuntime)."
  narrative: '{principal.name} can retrieve integration runtime auth keys from Synapse workspace (listAuthKeys/action
    or regenerateAuthKey/action), enabling registration of a persistent self-hosted IR node.'
move · open · esc close