azure-synapse-sql-pool-data-read

Synapse Administrator (or db_owner in the dedicated SQL pool) can query all data in the dedicated SQL pool.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Data`
source	`<principal>`
target	`<dedicated SQL pool (DataWarehouse)>`
permissions	`Synapse RBAC: Synapse Administrator (db_owner on dedicated SQL pool)`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when the dedicated SQL pool is in Running state; CONDITIONAL(service_state) when the pool is paused. Synapse Administrator automatically has db_owner; other principals require an explicit SQL role grant by the db_owner. SQL-level role grants are collected from the SQL plane, not ARM.

source type

Identity

target type

Data

source

<principal>

target

<dedicated SQL pool (DataWarehouse)>

permissions

Synapse RBAC: Synapse Administrator (db_owner on dedicated SQL pool)

conditions

iam_permission service_state

state logic

ACTIVE when the dedicated SQL pool is in Running state; CONDITIONAL(service_state) when the pool is paused. Synapse Administrator automatically has db_owner; other principals require an explicit SQL role grant by the db_owner. SQL-level role grants are collected from the SQL plane, not ARM.

Narrative

{principal.name} has Synapse Administrator role; has db_owner on dedicated SQL pool {target.name} and can read all data via SQL queries.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-sql-pool-data-read
emits: CanReadData
description: Synapse Administrator (or db_owner in the dedicated SQL pool) can query all data in the dedicated
  SQL pool.
match:
- - principal: null
  - HasRole
  - <Synapse Administrator role on workspace>
where:
- "Synapse RBAC role: Synapse Administrator at workspace scope \u2014 grants db_owner on all dedicated\
  \ SQL pools"
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <dedicated SQL pool (DataWarehouse)>
  permissions:
  - 'Synapse RBAC: Synapse Administrator (db_owner on dedicated SQL pool)'
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when the dedicated SQL pool is in Running state; CONDITIONAL(service_state) when
    the pool is paused. Synapse Administrator automatically has db_owner; other principals require an
    explicit SQL role grant by the db_owner. SQL-level role grants are collected from the SQL plane, not
    ARM.
  false_positive_note: "SQL access requires the pool to be Running (not Paused). Synapse Administrator\
    \ grants implicit db_owner on the dedicated pool, but SQL authentication also requires either AAD\
    \ login (via Azure AD admin) or SQL login \u2014 if azureADOnlyAuthentications is enabled, SQL auth\
    \ is blocked. The CanReadData edge here covers the authorization side; network access (VNet/private\
    \ endpoint firewall) is a separate condition."
  narrative: '{principal.name} has Synapse Administrator role; has db_owner on dedicated SQL pool {target.name}
    and can read all data via SQL queries.'