rage.fail

aws-apprunner-instance-metadata

Running service exposes instance-role credentials via the container credential endpoint.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'service': None} ExecutesAs {'role': None}

emit

source	`<AppRunner::Service>`
target	`<instance role>`
conditions	`trigger_exists`

Narrative

{service.name} exposes {role.name}'s credentials to any code running in the container (container credential endpoint).

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-instance-metadata
emits: ExposesCredential
description: Running service exposes instance-role credentials via the container credential endpoint.
match:
- - service: null
  - ExecutesAs
  - role: null
emit:
  source: <AppRunner::Service>
  target: <instance role>
  state: CONDITIONAL
  conditions:
  - trigger_exists
  derived_from:
  - <ExecutesAs edge_id>
  false_positive_note: "Only meaningful once an attacker has code/exec on the service (see CanExecuteAs\
    \ chains) or reads the injected env vars. This edge is a latent fact and MUST NOT be walked unconditionally:\
    \ traversal requires an inbound execution foothold into the service (CanExecuteAs / CanModifyCode\
    \ / ExposedToInternet + app-RCE). Without such an inbound edge it does not represent attacker-reachable\
    \ credential exposure \u2014 do not surface it ACTIVE across every service that merely has an instance\
    \ role.\n"
  narrative: '{service.name} exposes {role.name}''s credentials to any code running in the container (container
    credential endpoint).'