azure-synapse-spark-livy-submit

Synapse Compute Operator can submit Spark batch jobs and interactive sessions directly via the Apache Livy REST API endpoint at <workspace>.dev.azuresynapse.net/livyApi/..., triggering immediate job execution.

derived azure emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Spark pool (bigDataPool)>`
permissions	`Synapse RBAC: Synapse Compute Operator`
conditions	`service_state`
state logic	ACTIVE when at least one Spark pool exists in the workspace; CONDITIONAL(service_state) when no pool is configured or all pools are in a state that cannot accept new sessions. Livy job submission is a trigger/invoke pattern distinct from generic CanExecuteCommand because it operates at the Livy endpoint level (HTTP REST invocation, not platform command execution). CanTrigger feeds cicd-chains cicd-trigger-runner-executes-as for the CanExecuteAs roll-up.

source type

Identity

target type

AnalyticsService

source

<principal>

target

<Spark pool (bigDataPool)>

permissions

Synapse RBAC: Synapse Compute Operator

conditions

service_state

state logic

ACTIVE when at least one Spark pool exists in the workspace; CONDITIONAL(service_state) when no pool is configured or all pools are in a state that cannot accept new sessions. Livy job submission is a trigger/invoke pattern distinct from generic CanExecuteCommand because it operates at the Livy endpoint level (HTTP REST invocation, not platform command execution). CanTrigger feeds cicd-chains cicd-trigger-runner-executes-as for the CanExecuteAs roll-up.

Narrative

{principal.name} has Synapse Compute Operator; can submit Spark batch jobs or interactive sessions directly via the Livy REST API, triggering immediate execution on Spark pool {target.name} as the workspace MI.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-spark-livy-submit
emits: CanTrigger
description: Synapse Compute Operator can submit Spark batch jobs and interactive sessions directly via
  the Apache Livy REST API endpoint at <workspace>.dev.azuresynapse.net/livyApi/..., triggering immediate
  job execution.
match:
- - principal: null
  - HasRole
  - <Synapse Compute Operator role on workspace>
where:
- 'Synapse RBAC role: Synapse Compute Operator or Synapse Administrator at workspace scope'
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Spark pool (bigDataPool)>
  permissions:
  - 'Synapse RBAC: Synapse Compute Operator'
  conditions:
  - service_state
  state_logic: ACTIVE when at least one Spark pool exists in the workspace; CONDITIONAL(service_state)
    when no pool is configured or all pools are in a state that cannot accept new sessions. Livy job submission
    is a trigger/invoke pattern distinct from generic CanExecuteCommand because it operates at the Livy
    endpoint level (HTTP REST invocation, not platform command execution). CanTrigger feeds cicd-chains
    cicd-trigger-runner-executes-as for the CanExecuteAs roll-up.
  false_positive_note: Synapse Compute Operator is a data-plane role, separate from Azure RBAC. Livy is
    the only Spark job submission API for Synapse pools; the endpoint is at the workspace's development
    endpoint, not a separate resource. See also azure-synapse-spark-submit-job (CanExecuteCommand) for
    command execution semantics.
  derived_from: []
  note: 'This rule emits CanTrigger (job submission = triggering execution) distinct from CanExecuteCommand.
    Both are capabilities of Synapse Compute Operator but serve different purposes: CanTrigger feeds cicd-chains
    linchpin cicd-trigger-runner-executes-as (trigger + ExecutesAs -> CanExecuteAs), while CanExecuteCommand
    feeds can-execute-as execute-as-via-command (which does NOT apply to AnalyticsService). The separation
    allows for proper path-cost weighting in attack-path analysis.'
  narrative: '{principal.name} has Synapse Compute Operator; can submit Spark batch jobs or interactive
    sessions directly via the Livy REST API, triggering immediate execution on Spark pool {target.name}
    as the workspace MI.'