Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Use System-Assigned Managed Identities for Azure Machine Learning Workspaces

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: MachineLearning-003

Ensure that your Azure Machine Learning (ML) workspaces are using system-assigned managed identities in order to allow secure access to other Microsoft Azure protected resources such as key vaults and storage accounts. System-assigned managed identities minimizes risks, simplifies management, and maintains compliance with evolving cloud services.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security
Operational
excellence

Using system-assigned managed identities for Azure Machine Learning (ML) workspaces enhances security by allowing the ML workspaces to authenticate and authorize with Azure resources without the need for explicit credentials, reducing the risk associated with credential management and providing a seamless and more secure integration with other cloud services.


Audit

To determine if your Azure Machine Learning workspaces are configured to use system-assigned managed identities, perform the following actions:

Using Azure Console

01 Sign in to the Azure Management Console.

02 Navigate to Azure Machine Learning workspaces blade at https://portal.azure.com/#browse/Microsoft.MachineLearningServices%2Fworkspaces.

03 Select the Azure subscription that you want to examine from the Subscription filter box.

04 Click on the name (link) of the Azure Machine Learning workspace that you want to examine.

05 In the main navigation panel, select Overview, and choose JSON View under Essentials to access the workspace configuration information available in JSON format.

06 On the Resource JSON panel, check for the "identity.type" configuration attribute value in the resource configuration object, to determine the type of the managed identity configured for the selected workspace. If the "identity.type" attribute value is set to "UserAssigned", the selected Azure Machine Learning (ML) workspace is not using a system-assigned managed identity to authenticate to other cloud services.

07 Repeat steps no. 4 – 6 for each Azure Machine Learning workspace available within the selected subscription.

08 Repeat steps no. 3 – 7 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run ml workspace list command (Windows/macOS/Linux) with custom query filters to list the name and the associated resource group for each Azure Machine Learning workspace available in the current subscription:

az ml workspace list
  --output table
  --query '[*].{name:name, resourceGroup:resourceGroup}'

02 The command output should return the requested Azure Machine Learning workspace identifiers:

Name                           ResourceGroup
------------------------       ------------------------------
tm-ml-project5-workspace       cloud-shell-storage-westeurope
tm-ml-production-workspace     cloud-shell-storage-westeurope

03 Run ml workspace show command (Windows/macOS/Linux) with the name of the Azure Machine Learning workspace that you want to examine as the identifier parameter and custom output filters to determine the type of the managed identity configured for the selected workspace:

az ml workspace show
  --name tm-ml-project5-workspace
  --resource-group cloud-shell-storage-westeurope
  --query 'identity.type'

04 The command output should return the identity type used (system-assigned or user-assigned):

"user_assigned"

If the ml workspace show command output returns "user_assigned", as shown in the example above, the selected Azure Machine Learning (ML) workspace is not using a system-assigned managed identity to authenticate to other cloud services.

05 Repeat step no. 3 and 4 for each Azure Machine Learning workspace available in the selected Azure subscription.

06 Repeat steps no. 1 – 5 for each subscription created in your Microsoft Azure cloud account.

Remediation / Resolution

To ensure that your Azure Machine (ML) Learning workspaces are configured to use system-assigned managed identities, you must re-create your workspaces with the necessary identity configuration, by performing the following operations:

Using Azure Console

01 Sign in to the Azure Management Console.

02 Navigate to Azure Machine Learning workspaces blade at https://portal.azure.com/#browse/Microsoft.MachineLearningServices%2Fworkspaces.

03 Select the Azure subscription that you want to access from the Subscription equals all filter box, and choose Apply.

04 Choose Create, select New workspace, and perform the following actions to create your new Azure Machine Learning workspace:

  1. For Basics, provide the following information:
    1. For Subscription, choose your Azure subscription.
    2. For Resource group, select the correct resource group.
    3. Provide a unique name for the workspace in the Name box.
    4. For Region, select the Azure cloud region where the workspace will be deployed.
    5. For Storage account, choose the storage account that is used as the default datastore for the workspace.
    6. For Key vault, select the key vault used to store secrets and other sensitive information required by the workspace.
    7. For Application insights, choose whether to enable the Application Insights monitoring feature. You can create a new Azure Application Insights resource or select an existing one from your subscription.
    8. For Container registry, select the container registry used to register docker images used in training and deployments.
    9. Choose Next : Networking to continue the workspace setup process.
  2. For Networking, choose the type of network isolation that you need for your workspace. Choose Next : Encryption to continue the setup.
  3. For Encryption, perform the following actions:
    1. For Encryption type, choose Customer-managed keys to use your own Customer-Managed Key (CMK) for data encryption (recommended).
    2. For Key vault, choose Click to select the key, and select the appropriate key vault and Customer-Managed Key (CMK).
    3. Choose Next : Identity to continue.
  4. For Identity, perform the following operations:
    1. Choose System assigned identity for Identity type under Managed identity. A system-assigned managed identity enables the selected Azure Machine (ML) Learning workspace to authenticate to other cloud services without storing credentials in code.
    2. Select Identity-based access for Storage account access type under Storage account access.
    3. Under Data impact, check the High business impact workspace setting checkbox if you need to enable the High Business Impact (HBI) feature for your workspace.
    4. Choose Next : Tags to continue the setup.
  5. For Tags, use the Name and Value fields to create tags that will help organize the identity of the workspace. Choose Next : Review + create to validate the workspace setup.
  6. For Review + create, review the resource configuration details, then choose Create to create your new Azure Machine Learning workspace.

05 Repeat step no. 4 for each workspace that you want to re-create, available within the selected Azure subscription.

06 Repeat steps no. 3 – 5 for each subscription available in your Microsoft Azure cloud account.

Using Azure CLI

01 Define the configuration file for your new Azure Machine Learning (ML) workspace. Create a new configuration file (YAML format), name the file workspace-config.yml, and paste the configuration document listed below. Set identity.type to system_assigned to configure the identity type and replace other configuration parameter values with your own information):

$schema: https://azuremlschemas.azureedge.net/latest/workspace.schema.json
name: tm-new2-project5-workspace
location: westeurope
display_name: tm-new-project5-workspace
storage_account: /subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd1234
key_vault: /subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.KeyVault/vaults/1234abcd12341234abcd1234
identity:
	type: system_assigned

02 Run ml workspace create command (Windows/macOS/Linux) with the configuration file defined at the previous step (i.e. workspace-config.yml), to create your new Azure Machine Learning workspace:

az ml workspace create
  --resource-group cloud-shell-storage-westeurope
  --file workspace-config.yml

03 The command output should return the new workspace configuration information:

{
	"description": "tm-new-project5-workspace",
	"discovery_url": "https://westeurope.api.azureml.ms/discovery",
	"display_name": "tm-new-project5-workspace",
	"enable_data_isolation": false,
	"id": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.MachineLearningServices/workspaces/tm-new-project5-workspace",
	"identity": {
		"principal_id": "abcd1234-abcd-1234-abcd-1234abcd1234",
		"tenant_id": "abcd1234-abcd-1234-abcd-1234abcd1234",
		"type": "system_assigned"
	},
	"key_vault": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Keyvault/vaults/1234abcd12341234abcd1234",
	"location": "westeurope",
	"managed_network": {
		"isolation_mode": "disabled",
		"outbound_rules": []
	},
	"mlflow_tracking_uri": "azureml://westeurope.api.azureml.ms/mlflow/v1.0/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.MachineLearningServices/workspaces/tm-new-project5-workspace",
	"name": "tm-new-project5-workspace",
	"public_network_access": "Enabled",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"resource_group": "cloud-shell-storage-westeurope",
	"serverless_compute": {
		"no_public_ip": false
	},
	"storage_account": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd1234",
	"tags": {
		"AttachAppInsightsToWorkspace": "false",
		"createdByToolkit": "cli-v2-1.16.1"
	}
}

04 Repeat steps no. 1 - 3 for each workspace that you want to re-create, available in the selected Azure subscription.

05 Repeat steps no. 1 – 4 for each subscription available in your Microsoft Azure cloud account.

References

Publication date Jun 19, 2024

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Confirmity Cloud Platform

No thanks, back to article

You are auditing:

Use System-Assigned Managed Identities for Azure Machine Learning Workspaces

Risk Level: Medium