azure-aks-node-imds-executes-as

Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS and mints a token for the node system-assigned / kubelet MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'pod': None} {'pod': None} LocatedIn {'node': None} {'node': None} ExecutesAs {'node_mi': None}

where

node_type(?pod) in [KubernetesWorkload, Container] ?pod runs with hostNetwork: true OR hostPID: true OR is a privileged container OR is exec-accessible on the node node_type(?node) in [VirtualMachine, ContainerCluster] # the specific VMSS instance the pod runs on node_type(?node_mi) in [ManagedIdentity, MachineIdentity] ?node_mi is the system-assigned MI or kubelet user-assigned MI on the node

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?node_mi`
permissions	`<pods/exec create on ?pod \| runCommand \| listClusterAdminCredential>`
conditions	`service_state` `iam_permission`
state logic	ACTIVE when ?principal can exec into a pod with node-level access (hostNetwork/hostPID/privileged) on a specific node, that node is running, and it has an ExecutesAs edge to ?node_mi. CONDITIONAL(iam_permission) when the pod's level of node access is unknown or the node's MI binding is unconfirmed (standard unprivileged pods do NOT reach the node IMDS). BLOCKED if the cluster enforces Azure Policy / Pod Security Standards that prohibit privileged pods.

Narrative

{principal.name} can exec into a node-level pod ({pod.name}, hostNetwork/ privileged) on node {node.name} in cluster {cluster.name}; from inside, the node IMDS endpoint (169.254.169.254) returns a token for the node MI {node_mi.name}, so {principal.name} executes as {node_mi.name}.

Raw rule rules/derived/azure/aks.yaml

id: azure-aks-node-imds-executes-as
emits: CanExecuteAs
description: Node-level code execution (privileged pod, hostPID, DaemonSet exec) reaches the node IMDS
  and mints a token for the node system-assigned / kubelet MI.
match:
- - principal: null
  - CanExecuteCommand
  - pod: null
- - pod: null
  - LocatedIn
  - node: null
- - node: null
  - ExecutesAs
  - node_mi: null
where:
- node_type(?pod) in [KubernetesWorkload, Container]
- '?pod runs with hostNetwork: true OR hostPID: true OR is a privileged container OR is exec-accessible
  on the node'
- 'node_type(?node) in [VirtualMachine, ContainerCluster]  # the specific VMSS instance the pod runs on'
- node_type(?node_mi) in [ManagedIdentity, MachineIdentity]
- ?node_mi is the system-assigned MI or kubelet user-assigned MI on the node
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?node_mi
  permissions:
  - <pods/exec create on ?pod | runCommand | listClusterAdminCredential>
  conditions:
  - service_state
  - iam_permission
  state_logic: ACTIVE when ?principal can exec into a pod with node-level access (hostNetwork/hostPID/privileged)
    on a specific node, that node is running, and it has an ExecutesAs edge to ?node_mi. CONDITIONAL(iam_permission)
    when the pod's level of node access is unknown or the node's MI binding is unconfirmed (standard unprivileged
    pods do NOT reach the node IMDS).  BLOCKED if the cluster enforces Azure Policy / Pod Security Standards
    that prohibit privileged pods.
  confidence: 0.8
  derived_from:
  - <CanExecuteCommand edge_id>
  - <LocatedIn edge_id (pod -> node)>
  - <ExecutesAs edge_id (node -> node MI)>
  - can-execute-as.yaml#execute-as-via-command
  false_positive_note: "Node IMDS (169.254.169.254) is reachable only from the node itself or from pods\
    \ with hostNetwork: true or other host-level access.  Regular unprivileged pods do NOT reach the node\
    \ IMDS \u2014 they can only access their projected SA token. Only emit when the exec target pod actually\
    \ has node-level access (hostNetwork/ hostPID/privileged) on the SPECIFIC node where the ExecutesAs\
    \ binding exists. Do NOT Cartesian-product every CanExecuteCommand pod with every node MI in the cluster\
    \ \u2014 enforce the pod-to-node placement via LocatedIn.  Do NOT emit for standard restricted pods.\
    \ Escalation guard: emit only when the node MI privilege_level >= principal's. The escalation roll-up\
    \ is can-control escalate-via-execute-as \u2014 not re-derived."
  narrative: '{principal.name} can exec into a node-level pod ({pod.name}, hostNetwork/ privileged) on
    node {node.name} in cluster {cluster.name}; from inside, the node IMDS endpoint (169.254.169.254)
    returns a token for the node MI {node_mi.name}, so {principal.name} executes as {node_mi.name}.'