azure-adf-pipeline-retrieve-mi-token

Custom activities in ADF pipelines (running on Batch pools) can request a bearer token for the factory MI via the Azure IMDS endpoint.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Custom activity execution context (BatchJob/Batch pool node, Compute class)>`
target	`<managed identity bound to the factory>`
state logic	ACTIVE when the factory has a managed identity (identity.type != None). A Custom activity in the pipeline executes on an Azure Batch pool (Compute class); from that pool node, the activity code can call the Azure IMDS endpoint (169.254.169.254) to obtain the factory MI bearer token. Not emitted when the factory has no MI. Web activities use an internal ADF MSI relay and are tracked via a separate derivation (cited in CanExecuteAs paths).

source type

Compute

target type

Identity

source

<Custom activity execution context (BatchJob/Batch pool node, Compute class)>

target

<managed identity bound to the factory>

state logic

ACTIVE when the factory has a managed identity (identity.type != None). A Custom activity in the pipeline executes on an Azure Batch pool (Compute class); from that pool node, the activity code can call the Azure IMDS endpoint (169.254.169.254) to obtain the factory MI bearer token. Not emitted when the factory has no MI. Web activities use an internal ADF MSI relay and are tracked via a separate derivation (cited in CanExecuteAs paths).

Narrative

Custom activity code running in ADF factory pipeline can request a bearer token for managed identity {mi.name} via IMDS (169.254.169.254), enabling authenticated calls to any Azure service the MI is authorized to access.

Raw rule rules/derived/azure/datafactory.yaml

id: azure-adf-pipeline-retrieve-mi-token
emits: CanRetrieveToken
description: Custom activities in ADF pipelines (running on Batch pools) can request a bearer token for
  the factory MI via the Azure IMDS endpoint.
match:
- - batchjob: null
  - ExecutesAs
  - mi: null
where:
- node_type(?batchjob) == BatchJob
- ?batchjob is a Custom activity execution context (Batch pool node) within an ADF factory
- ?batchjob is part of a pipeline that runs the Custom activity
emit:
  source_type: Compute
  target_type: Identity
  source: <Custom activity execution context (BatchJob/Batch pool node, Compute class)>
  target: <managed identity bound to the factory>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the factory has a managed identity (identity.type != None). A Custom activity
    in the pipeline executes on an Azure Batch pool (Compute class); from that pool node, the activity
    code can call the Azure IMDS endpoint (169.254.169.254) to obtain the factory MI bearer token. Not
    emitted when the factory has no MI. Web activities use an internal ADF MSI relay and are tracked via
    a separate derivation (cited in CanExecuteAs paths).
  confidence: 0.88
  derived_from:
  - '<ExecutesAs edge: ?batchjob -> ?mi>'
  false_positive_note: "Only Custom activity execution (Batch pool, Compute class) emits this edge. Web\
    \ activities use an internal ADF MSI token relay (not IMDS) and are handled via CanExecuteAs derivations.\
    \ The source must be Compute (BatchJob) to conform to CanRetrieveToken's schema. This edge is the\
    \ fact that Custom activity code running AS the pipeline's MI can mint the factory MI's token \u2014\
    \ it becomes an attack step when combined with CanModifyCode (Custom activity definition modification)\
    \ or CanInvoke (triggering a pipeline containing the Custom activity)."
  narrative: Custom activity code running in ADF factory pipeline can request a bearer token for managed
    identity {mi.name} via IMDS (169.254.169.254), enabling authenticated calls to any Azure service the
    MI is authorized to access.