rage.fail

aws-asg-instance-imds-token

Instances launched by the ASG expose the instance-profile role's credentials via IMDS.

derived aws emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'role': None}

where

?role is the instance-profile role of the launched instances IMDS is reachable (not fully disabled; IMDSv2 hop/token still yields creds to on-host code)

emit

source	`<principal>`
target	`<instance-profile role>`
conditions	`service_state`

Narrative

{principal.name}, executing on ASG-launched instances, can read {role.name} credentials from the instance metadata service (IMDS).

Raw rule rules/derived/aws/autoscaling.yaml

id: aws-asg-instance-imds-token
emits: CanRetrieveToken
description: Instances launched by the ASG expose the instance-profile role's credentials via IMDS.
match:
- - principal: null
  - CanExecuteAs
  - role: null
where:
- ?role is the instance-profile role of the launched instances
- IMDS is reachable (not fully disabled; IMDSv2 hop/token still yields creds to on-host code)
emit:
  source: <principal>
  target: <instance-profile role>
  permissions: []
  conditions:
  - service_state
  false_positive_note: If the launch template sets HttpEndpoint=disabled, on-host code cannot read IMDS
    creds; IMDSv2 required-mode still permits local code to fetch a token. Do not claim token retrieval
    when IMDS is disabled.
  narrative: '{principal.name}, executing on ASG-launched instances, can read {role.name} credentials
    from the instance metadata service (IMDS).'