azure-synapse-linkedservice-exposes-cred
A Synapse linked service that stores credentials as plaintext (SQL auth password, storage key, SAS token) exposes those credentials to any principal with Synapse Linked Data Manager or Synapse Administrator role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?linkedService) ==
ConnectionString
?linkedService authentication type is NOT ManagedIdentity — it contains embedded credentials (SQL auth, account key, SAS, service principal secret)
emit
| source type | Data |
|---|---|
| target type | Credential |
| source | <linked service node> |
| target | <embedded credential (ConnectionString / AccessKey)> |
| permissions | Synapse RBAC: Synapse Linked Data Manager or Synapse Administrator (data plane) |
Narrative
Linked service {linkedService.name} in workspace {workspace.name} contains embedded credentials readable by any Synapse Linked Data Manager or Administrator.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-linkedservice-exposes-cred
emits: ExposesCredential
description: A Synapse linked service that stores credentials as plaintext (SQL auth password, storage
key, SAS token) exposes those credentials to any principal with Synapse Linked Data Manager or Synapse
Administrator role.
match:
- - workspace: null
- Contains
- linkedService: null
where:
- node_type(?linkedService) == ConnectionString
- "?linkedService authentication type is NOT ManagedIdentity \u2014 it contains embedded credentials (SQL\
\ auth, account key, SAS, service principal secret)"
emit:
source_type: Data
target_type: Credential
source: <linked service node>
target: <embedded credential (ConnectionString / AccessKey)>
permissions:
- 'Synapse RBAC: Synapse Linked Data Manager or Synapse Administrator (data plane)'
false_positive_note: Only emit when the linked service definition contains actual credential material
(auth type != ManagedIdentity/MSI). A linked service that uses MI auth exposes no credential. The
read path requires a Synapse RBAC role, not just ARM Reader. Presence of a linked service node in
the graph is a recon fact; ExposesCredential requires the credential to actually be present in the
definition.
narrative: Linked service {linkedService.name} in workspace {workspace.name} contains embedded credentials
readable by any Synapse Linked Data Manager or Administrator.