rage.fail

aws-ec2-imds-exposes-role

The instance itself exposes its role's credentials via IMDS.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'instance': None} ExecutesAs {'role': None}

where

instance MetadataOptions.HttpEndpoint == enabled

emit

source	`<EC2 instance>`
target	`<IAM role>`
conditions	`service_state`
state logic	ACTIVE if HttpEndpoint enabled else BLOCKED

Narrative

{instance.name} exposes {role.name}'s STS credentials through the instance metadata service.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-imds-exposes-role
emits: ExposesCredential
description: The instance itself exposes its role's credentials via IMDS.
match:
- - instance: null
  - ExecutesAs
  - role: null
where:
- instance MetadataOptions.HttpEndpoint == enabled
emit:
  source: <EC2 instance>
  target: <IAM role>
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE if HttpEndpoint enabled else BLOCKED
  false_positive_note: Zero-value if HttpEndpoint disabled. Combined with ExposedToInternet + an SSRF-able
    app, off-host attackers can reach IMDS unless IMDSv2+hop-limit-1 enforced.
  narrative: '{instance.name} exposes {role.name}''s STS credentials through the instance metadata service.'