aws-beanstalk-imds-exposes-credential

Beanstalk EC2 instances leak the instance profile creds via IMDS (169.254.169.254).

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`<Elastic Beanstalk environment>`
target	`<instance profile role>`
conditions	`network_reachability` `service_state`
state logic	CONDITIONAL(trigger_exists\|network_reachability) by default -- becomes ACTIVE only when a companion CanExecuteAs(?principal, ?role) edge exists (on-host code exec achieved) or a reachable SSRF path is confirmed with IMDS hardening unknown. This explicit exposure fact must not assert ACTIVE on unproven code execution.

source

<Elastic Beanstalk environment>

target

<instance profile role>

conditions

network_reachability service_state

state logic

CONDITIONAL(trigger_exists|network_reachability) by default -- becomes ACTIVE only when a companion CanExecuteAs(?principal, ?role) edge exists (on-host code exec achieved) or a reachable SSRF path is confirmed with IMDS hardening unknown. This explicit exposure fact must not assert ACTIVE on unproven code execution.

Narrative

{environment.name} exposes {role.name} credentials via the EC2 instance metadata service (IMDS).

Raw rule rules/derived/aws/beanstalk.yaml

id: aws-beanstalk-imds-exposes-credential
emits: ExposesCredential
description: Beanstalk EC2 instances leak the instance profile creds via IMDS (169.254.169.254).
match:
- - environment: null
  - ExecutesAs
  - role: null
where:
- node_type(?environment) == ApplicationPlatform (Beanstalk environment backed by EC2)
- ?role is the INSTANCE PROFILE role (not the service role)
emit:
  source: <Elastic Beanstalk environment>
  target: <instance profile role>
  state_logic: CONDITIONAL(trigger_exists|network_reachability) by default -- becomes ACTIVE only when
    a companion CanExecuteAs(?principal, ?role) edge exists (on-host code exec achieved) or a reachable
    SSRF path is confirmed with IMDS hardening unknown. This explicit exposure fact must not assert ACTIVE
    on unproven code execution.
  conditions:
  - network_reachability
  - service_state
  false_positive_note: This is the leak fact only. IMDSv2 with hop-limit 1 blocks most SSRF-to-credential
    abuse; on-host code exec still works. Mark SSRF-only paths CONDITIONAL when instance metadata hardening
    is unknown. Only meaningful once an inbound execution edge (CanExecuteAs/CanModifyCode) or a reachable
    SSRF into the app exists.
  narrative: '{environment.name} exposes {role.name} credentials via the EC2 instance metadata service
    (IMDS).'