Control: 3.1.6 Ensure that usage is restricted and expiry is enforced for Databricks personal access tokens
Description
Databricks personal access tokens (PATs) provide API-based authentication for users and applications. By default, users can generate API tokens without expiration, leading to potential security risks if tokens are leaked, improperly stored, or not rotated regularly.
To mitigate these risks, administrators should:
- Restrict token creation to approved users and service principals.
- Enforce expiration policies to prevent long-lived tokens.
- Monitor token usage and revoke unused or compromised tokens.
Restricting usage and enforcing expiry for personal access tokens reduces exposure to long-lived tokens, minimizes the risk of API abuse if compromised, and aligns with security best practices through controlled issuance and enforced expiry.
Remediation
From Azure Portal
Disable personal access tokens:
If your workspace does not require PATs, you can disable them entirely to prevent their use.
- Navigate to your Azure Databricks workspace.
- Click the
Settingsicon and selectAdmin Console. - Go to the
Advancedtab. - Under
Personal Access Tokens, toggle the setting toDisabled.
Databricks CLI:
databricks workspace-conf set-status --json '{"enableTokens": "false"}'
Control who can create and use personal access tokens:
Define which users or groups are authorized to create and utilize PATs.
- Navigate to your Azure Databricks workspace.
- Click the
Settingsicon and selectAdmin Console. - Go to the
Advancedtab. - Click on
Personal Access Tokensand thenPermissions. - Assign the appropriate permissions (e.g. No Permissions, Can Use, Can Manage) to users or groups.
Set maximum lifetime for new personal access tokens:
Limit the validity period of new tokens to reduce potential misuse.
Databricks CLI:
databricks workspace-conf set-status --json '{"maxTokenLifetimeDays": "90"}'
Monitor and revoke personal access tokens:
Periodically review active tokens and revoke any that are unnecessary or potentially compromised.
Databricks CLI:
databricks token list
databricks token delete --token-id <token-id>
Transition to OAuth for enhanced security:
Utilize OAuth tokens for authentication, offering improved security features over PATs.
Default Value
By default, personal access tokens are enabled and users can create the Personal access token and their expiry time.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v400_3_1_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v400_3_1_6 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;