azure-aml-compute-imds-exposescred
Any code running on an AML compute node can mint the compute MI's token from IMDS - the MI credential is exposed to all job code.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
emit
| source type | Compute |
|---|---|
| target type | ManagedIdentity |
| source | <AML compute cluster, compute instance, or online endpoint deployment> |
| target | <managed identity (system-assigned or user-assigned)> |
Narrative
{compute.name} exposes the credential of its managed identity {mi.name} to any code running on its nodes via IMDS (169.254.169.254), including all training job commands and notebook cells.
Raw rule rules/derived/azure/machinelearning.yaml
id: azure-aml-compute-imds-exposescred
emits: ExposesCredential
description: "Any code running on an AML compute node can mint the compute MI's token from IMDS \u2014\
\ the MI credential is exposed to all job code."
match:
- - compute: null
- ExecutesAs
- mi: null
where:
- node_type(?compute) in [BatchJob, VirtualMachine, Notebook]
- node_type(?mi) in [ManagedIdentity]
emit:
source_type: Compute
target_type: ManagedIdentity
source: <AML compute cluster, compute instance, or online endpoint deployment>
target: <managed identity (system-assigned or user-assigned)>
permissions: []
derived_from:
- <ExecutesAs edge_id>
false_positive_note: Only fires when the compute has a managed identity (identity.type != None). If
the compute has no MI, IMDS returns an error and there is no credential to expose. System-assigned
MI for online endpoints has limited scope by default; verify the MI's RBAC grants before asserting
high-value escalation.
narrative: '{compute.name} exposes the credential of its managed identity {mi.name} to any code running
on its nodes via IMDS (169.254.169.254), including all training job commands and notebook cells.'