azure-synapse-pipeline-artifact-publish

Synapse Artifact Publisher role allows publishing pipelines with arbitrary Spark/custom/web activities; the workspace Workflow node executes them as the workspace MI.

derived azure emits CanModifyCode

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Synapse workspace (Workflow/pipeline execution surface)>`
permissions	`Synapse RBAC: Synapse Artifact Publisher`
conditions	`trigger_exists`
state logic	ACTIVE if the principal can also trigger the pipeline (Synapse Compute Operator role or an existing/creatable trigger) so the published code actually runs; CONDITIONAL(trigger_exists) if only the publish role is held and no trigger or run permission is confirmed — the code is planted but needs a run path. Inherit weakest with the Synapse RBAC role evidence confidence.

source type

Identity

target type

AnalyticsService

source

<principal>

target

<Synapse workspace (Workflow/pipeline execution surface)>

permissions

Synapse RBAC: Synapse Artifact Publisher

conditions

trigger_exists

state logic

ACTIVE if the principal can also trigger the pipeline (Synapse Compute Operator role or an existing/creatable trigger) so the published code actually runs; CONDITIONAL(trigger_exists) if only the publish role is held and no trigger or run permission is confirmed — the code is planted but needs a run path. Inherit weakest with the Synapse RBAC role evidence confidence.

Narrative

{principal.name} has Synapse Artifact Publisher on workspace {target.name}; can publish a pipeline containing attacker-controlled Spark or custom activity code that runs as the workspace MI when triggered.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-pipeline-artifact-publish
emits: CanModifyCode
description: Synapse Artifact Publisher role allows publishing pipelines with arbitrary Spark/custom/web
  activities; the workspace Workflow node executes them as the workspace MI.
match:
- - principal: null
  - HasRole
  - <Synapse Artifact Publisher role on workspace>
where:
- 'Synapse RBAC role: Synapse Artifact Publisher at workspace scope'
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Synapse workspace (Workflow/pipeline execution surface)>
  permissions:
  - 'Synapse RBAC: Synapse Artifact Publisher'
  conditions:
  - trigger_exists
  state_logic: "ACTIVE if the principal can also trigger the pipeline (Synapse Compute Operator role or\
    \ an existing/creatable trigger) so the published code actually runs; CONDITIONAL(trigger_exists)\
    \ if only the publish role is held and no trigger or run permission is confirmed \u2014 the code is\
    \ planted but needs a run path. Inherit weakest with the Synapse RBAC role evidence confidence."
  false_positive_note: "Artifact Publisher alone plants the code but does not trigger execution; the Synapse\
    \ Compute Operator role (or a co-holder of that role) provides the run path. Model these as separate\
    \ facts; the CanModifyCode edge carries trigger_exists condition. Synapse RBAC is separate from Azure\
    \ RBAC \u2014 an ARM Contributor is NOT automatically an Artifact Publisher."
  narrative: '{principal.name} has Synapse Artifact Publisher on workspace {target.name}; can publish
    a pipeline containing attacker-controlled Spark or custom activity code that runs as the workspace
    MI when triggered.'