azure-synapse-serverless-sql-data-read

Serverless SQL pool allows querying ADLS Gen2 files directly via OPENROWSET; Synapse Administrator has db_owner (dbo) on the built-in serverless pool and can read any data the workspace MI can reach.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Data`
source	`<principal>`
target	`<workspace ADLS Gen2 storage (DataLake)>`
permissions	`Synapse RBAC: Synapse Administrator (dbo on serverless SQL pool)`
conditions	`iam_permission` `network_reachability`
state logic	ACTIVE when the workspace has access to the ADLS Gen2 workspace storage account (Storage Blob Data Contributor is granted to the workspace MI by default). Other ADLS paths are CONDITIONAL(iam_permission) on whether the workspace MI holds the appropriate RBAC on those paths. Serverless pool is always available (serverless, no pause state).

source type

Identity

target type

Data

source

<principal>

target

<workspace ADLS Gen2 storage (DataLake)>

permissions

Synapse RBAC: Synapse Administrator (dbo on serverless SQL pool)

conditions

iam_permission network_reachability

state logic

ACTIVE when the workspace has access to the ADLS Gen2 workspace storage account (Storage Blob Data Contributor is granted to the workspace MI by default). Other ADLS paths are CONDITIONAL(iam_permission) on whether the workspace MI holds the appropriate RBAC on those paths. Serverless pool is always available (serverless, no pause state).

Narrative

{principal.name} has Synapse Administrator role; has dbo on the serverless SQL pool and can query ADLS Gen2 data via OPENROWSET on any path the workspace MI holds Storage Blob Data Reader or greater.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-serverless-sql-data-read
emits: CanReadData
description: Serverless SQL pool allows querying ADLS Gen2 files directly via OPENROWSET; Synapse Administrator
  has db_owner (dbo) on the built-in serverless pool and can read any data the workspace MI can reach.
match:
- - principal: null
  - HasRole
  - <Synapse Administrator role on workspace>
where:
- "Synapse RBAC role: Synapse Administrator \u2014 grants dbo on serverless SQL pool 'Built-in'"
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <workspace ADLS Gen2 storage (DataLake)>
  permissions:
  - 'Synapse RBAC: Synapse Administrator (dbo on serverless SQL pool)'
  conditions:
  - iam_permission
  - network_reachability
  state_logic: ACTIVE when the workspace has access to the ADLS Gen2 workspace storage account (Storage
    Blob Data Contributor is granted to the workspace MI by default). Other ADLS paths are CONDITIONAL(iam_permission)
    on whether the workspace MI holds the appropriate RBAC on those paths. Serverless pool is always available
    (serverless, no pause state).
  false_positive_note: Serverless SQL pool scope is governed by what the OPENROWSET caller can access
    in storage (either via the workspace MI's permissions or via explicit storage credentials). Synapse
    Administrator's dbo grants SQL-level access; the actual data returned is filtered by storage ACLs
    on the files. Do not over-claim scope to storage the workspace MI cannot reach.
  narrative: '{principal.name} has Synapse Administrator role; has dbo on the serverless SQL pool and
    can query ADLS Gen2 data via OPENROWSET on any path the workspace MI holds Storage Blob Data Reader
    or greater.'