aws-beanstalk-imds-token

Code on a Beanstalk instance (or SSRF against the app) reads the instance profile creds from IMDS.

derived aws emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`<Elastic Beanstalk environment>`
target	`<instance profile role>`
conditions	`network_reachability` `service_state`
state logic	CONDITIONAL(trigger_exists\|network_reachability) by default -- becomes ACTIVE only when a companion CanExecuteAs(?principal, ?role) edge exists (on-host code exec) or a reachable SSRF path is confirmed with IMDS hardening unknown. The explicit edge cannot itself know code exec was achieved, so it stays CONDITIONAL until a realizing edge is present.

source

<Elastic Beanstalk environment>

target

<instance profile role>

conditions

network_reachability service_state

state logic

CONDITIONAL(trigger_exists|network_reachability) by default -- becomes ACTIVE only when a companion CanExecuteAs(?principal, ?role) edge exists (on-host code exec) or a reachable SSRF path is confirmed with IMDS hardening unknown. The explicit edge cannot itself know code exec was achieved, so it stays CONDITIONAL until a realizing edge is present.

Narrative

{environment.name} exposes {role.name} credentials via the EC2 instance metadata service (IMDS).

Raw rule rules/derived/aws/beanstalk.yaml

id: aws-beanstalk-imds-token
emits: CanRetrieveToken
description: Code on a Beanstalk instance (or SSRF against the app) reads the instance profile creds from
  IMDS.
match:
- - environment: null
  - ExecutesAs
  - role: null
where:
- node_type(?environment) == ApplicationPlatform (Beanstalk environment backed by EC2)
- ?role is the INSTANCE PROFILE role (not the service role)
emit:
  source: <Elastic Beanstalk environment>
  target: <instance profile role>
  state_logic: CONDITIONAL(trigger_exists|network_reachability) by default -- becomes ACTIVE only when
    a companion CanExecuteAs(?principal, ?role) edge exists (on-host code exec) or a reachable SSRF path
    is confirmed with IMDS hardening unknown. The explicit edge cannot itself know code exec was achieved,
    so it stays CONDITIONAL until a realizing edge is present.
  conditions:
  - network_reachability
  - service_state
  false_positive_note: IMDSv2 with hop-limit 1 blocks most SSRF-to-credential abuse; on-host code exec
    still works. Mark SSRF-only paths CONDITIONAL when instance metadata hardening is unknown.
  narrative: '{environment.name} exposes {role.name} credentials via the EC2 instance metadata service
    (IMDS).'