azure-synapse-workspace-imds-exposescred
The Synapse workspace exposes the workspace managed identity credential to all Spark jobs and pipeline activities via IMDS (169.254.169.254).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?workspace) ==
AnalyticsService
node_type(?mi) == ManagedIdentity
emit
| source type | Data |
|---|---|
| target type | Credential |
| source | <Synapse workspace> |
| target | <workspace managed identity> |
Narrative
Synapse workspace {workspace.name} exposes the credential of its managed identity {mi.name} to all Spark jobs, pipeline activities, and notebooks via IMDS.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-workspace-imds-exposescred
emits: ExposesCredential
description: The Synapse workspace exposes the workspace managed identity credential to all Spark jobs
and pipeline activities via IMDS (169.254.169.254).
match:
- - workspace: null
- ExecutesAs
- mi: null
where:
- node_type(?workspace) == AnalyticsService
- node_type(?mi) == ManagedIdentity
emit:
source_type: Data
target_type: Credential
source: <Synapse workspace>
target: <workspace managed identity>
permissions: []
note: 'Any code running in a Spark job, pipeline activity, or notebook can GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=<aud>
with header ''Metadata: true'' to mint a token for the workspace MI. The companion CanRetrieveToken(workspace
-> MI) edge is emitted by azure-synapse-imds-token.'
false_positive_note: Only fires when the workspace has a system-assigned or user-assigned MI (verify
workspace identity.type). This edge alone is not an escalation step; it becomes one when combined
with a code-execution or trigger capability.
narrative: Synapse workspace {workspace.name} exposes the credential of its managed identity {mi.name}
to all Spark jobs, pipeline activities, and notebooks via IMDS.