azure-synapse-spark-submit-job

Synapse Compute Operator role (or Synapse Administrator) allows submitting Spark batch jobs and interactive sessions via the Livy API, running attacker-supplied code on Spark workers.

derived azure emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Spark pool (bigDataPool)>`
permissions	`Synapse RBAC: Synapse Compute Operator`
conditions	`service_state`
state logic	ACTIVE when at least one Spark pool exists in the workspace; CONDITIONAL(service_state) when no Spark pool is configured or all pools are in a state that cannot accept new sessions. Synapse Compute Operator allows submitting jobs via Livy REST (POST to <workspace>.dev.azuresynapse.net/livyApi/versions/2019-11-01-preview/sparkPools/<pool>/batches).

source type

Identity

target type

AnalyticsService

source

<principal>

target

<Spark pool (bigDataPool)>

permissions

Synapse RBAC: Synapse Compute Operator

conditions

service_state

state logic

ACTIVE when at least one Spark pool exists in the workspace; CONDITIONAL(service_state) when no Spark pool is configured or all pools are in a state that cannot accept new sessions. Synapse Compute Operator allows submitting jobs via Livy REST (POST to <workspace>.dev.azuresynapse.net/livyApi/versions/2019-11-01-preview/sparkPools/<pool>/batches).

Narrative

{principal.name} has Synapse Compute Operator role on workspace {workspace.name}; can submit arbitrary Spark batch jobs or interactive sessions to Spark pool {target.name} via the Livy REST API.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-spark-submit-job
emits: CanExecuteCommand
description: Synapse Compute Operator role (or Synapse Administrator) allows submitting Spark batch jobs
  and interactive sessions via the Livy API, running attacker-supplied code on Spark workers.
match:
- - principal: null
  - HasRole
  - <Synapse Compute Operator role on workspace>
where:
- 'Synapse RBAC role: Synapse Compute Operator or Synapse Administrator at workspace scope'
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Spark pool (bigDataPool)>
  permissions:
  - 'Synapse RBAC: Synapse Compute Operator'
  conditions:
  - service_state
  state_logic: ACTIVE when at least one Spark pool exists in the workspace; CONDITIONAL(service_state)
    when no Spark pool is configured or all pools are in a state that cannot accept new sessions. Synapse
    Compute Operator allows submitting jobs via Livy REST (POST to <workspace>.dev.azuresynapse.net/livyApi/versions/2019-11-01-preview/sparkPools/<pool>/batches).
  false_positive_note: "Synapse RBAC Compute Operator is a data-plane role, separate from Azure RBAC.\
    \ An ARM Contributor without this Synapse role CANNOT submit Spark jobs. Synapse Administrator implicitly\
    \ has Compute Operator capabilities. Emitted as CanExecuteCommand because the Spark pool is an AnalyticsService,\
    \ not a VirtualMachine/ContainerService \u2014 the semantic is that arbitrary code runs on the Spark\
    \ worker nodes. The execution is AS the workspace MI, captured separately by ExecutesAs + can-execute-as.yaml\
    \ linchpin."
  narrative: '{principal.name} has Synapse Compute Operator role on workspace {workspace.name}; can submit
    arbitrary Spark batch jobs or interactive sessions to Spark pool {target.name} via the Livy REST API.'