rage.fail

azure-aml-compute-imds-token

Any code on an AML compute node can mint a bearer token for the compute MI via IMDS.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'compute': None} ExecutesAs {'mi': None}

where

node_type(?compute) in [BatchJob, VirtualMachine, Notebook] node_type(?mi) in [ManagedIdentity]

emit

source type	`Compute`
target type	`ManagedIdentity`
source	`<AML compute cluster, compute instance, or online endpoint deployment>`
target	`<managed identity>`

Narrative

Any job or notebook cell on {compute.name} can request a bearer token for {mi.name} from IMDS (169.254.169.254) with no additional credential.

Raw rule rules/derived/azure/machinelearning.yaml

id: azure-aml-compute-imds-token
emits: CanRetrieveToken
description: Any code on an AML compute node can mint a bearer token for the compute MI via IMDS.
match:
- - compute: null
  - ExecutesAs
  - mi: null
where:
- node_type(?compute) in [BatchJob, VirtualMachine, Notebook]
- node_type(?mi) in [ManagedIdentity]
emit:
  source_type: Compute
  target_type: ManagedIdentity
  source: <AML compute cluster, compute instance, or online endpoint deployment>
  target: <managed identity>
  permissions: []
  derived_from:
  - <ExecutesAs edge_id>
  note: 'IMDS: GET http://169.254.169.254/metadata/identity/oauth2/token? api-version=2018-02-01&resource=https://management.azure.com/
    with header ''Metadata: true''. Companion to azure-aml-compute-imds-exposescred.'
  false_positive_note: "Only fires when the compute has a managed identity. No MI \u2192 no token. Do\
    \ not emit for the workspace system-assigned MI unless the compute explicitly inherits it (identity.type\
    \ == SystemAssigned on the compute ARM resource)."
  narrative: Any job or notebook cell on {compute.name} can request a bearer token for {mi.name} from
    IMDS (169.254.169.254) with no additional credential.