azure-synapse-pipeline-trigger

Synapse Compute Operator role allows triggering pipeline runs (createPipelineRun) on the workspace, executing whatever pipeline definition is currently published.

derived azure emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Synapse workspace (pipeline execution surface)>`
permissions	`Synapse RBAC: Synapse Compute Operator`
conditions	`trigger_exists`
state logic	ACTIVE when a published pipeline exists in the workspace that the principal can trigger; CONDITIONAL(trigger_exists) if no pipeline is currently published. The trigger alone yields CanExecuteAs only if the current pipeline definition already runs attacker-influenced code (poisoned notebook reference, tampered definition) — see cicd-chains linchpin cicd-trigger-runner-executes-as. If the principal ALSO has Artifact Publisher (CanModifyCode), the combined path is ACTIVE (cicd rule 1).

source type

Identity

target type

AnalyticsService

source

<principal>

target

<Synapse workspace (pipeline execution surface)>

permissions

Synapse RBAC: Synapse Compute Operator

conditions

trigger_exists

state logic

ACTIVE when a published pipeline exists in the workspace that the principal can trigger; CONDITIONAL(trigger_exists) if no pipeline is currently published. The trigger alone yields CanExecuteAs only if the current pipeline definition already runs attacker-influenced code (poisoned notebook reference, tampered definition) — see cicd-chains linchpin cicd-trigger-runner-executes-as. If the principal ALSO has Artifact Publisher (CanModifyCode), the combined path is ACTIVE (cicd rule 1).

Narrative

{principal.name} has Synapse Compute Operator role; can trigger pipeline runs on Synapse workspace {target.name} (createPipelineRun or existing trigger), executing current pipeline definitions as the workspace MI.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-pipeline-trigger
emits: CanTrigger
description: Synapse Compute Operator role allows triggering pipeline runs (createPipelineRun) on the
  workspace, executing whatever pipeline definition is currently published.
match:
- - principal: null
  - HasRole
  - <Synapse Compute Operator role on workspace>
where:
- 'Synapse RBAC role: Synapse Compute Operator or Synapse Administrator at workspace scope'
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Synapse workspace (pipeline execution surface)>
  permissions:
  - 'Synapse RBAC: Synapse Compute Operator'
  conditions:
  - trigger_exists
  state_logic: "ACTIVE when a published pipeline exists in the workspace that the principal can trigger;\
    \ CONDITIONAL(trigger_exists) if no pipeline is currently published. The trigger alone yields CanExecuteAs\
    \ only if the current pipeline definition already runs attacker-influenced code (poisoned notebook\
    \ reference, tampered definition) \u2014 see cicd-chains linchpin cicd-trigger-runner-executes-as.\
    \ If the principal ALSO has Artifact Publisher (CanModifyCode), the combined path is ACTIVE (cicd\
    \ rule 1)."
  false_positive_note: "CanTrigger over a clean, trusted, pinned pipeline definition is CONDITIONAL (attacker_influenced_definition)\
    \ per cicd-chains. Do NOT emit ACTIVE CanExecuteAs merely from CanTrigger; only do so when the definition\
    \ is attacker-influenced or the principal also holds CanModifyCode on the pipeline. CITE cicd-chains.yaml\
    \ cicd-trigger-runner-executes-as for the CanExecuteAs roll-up \u2014 do not re-derive."
  narrative: '{principal.name} has Synapse Compute Operator role; can trigger pipeline runs on Synapse
    workspace {target.name} (createPipelineRun or existing trigger), executing current pipeline definitions
    as the workspace MI.'