azure-auto-exposes-mi-token

An Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`GenericCompute`
target type	`ManagedIdentity`
source	`?runbook`
target	`?identity`
state logic	ACTIVE when the account has a bound MI (ExecutesAs confirmed) and a runbook can execute in the sandbox. CONDITIONAL(service_state) if the account is suspended.

source type

GenericCompute

target type

ManagedIdentity

source

?runbook

target

?identity

state logic

ACTIVE when the account has a bound MI (ExecutesAs confirmed) and a runbook can execute in the sandbox. CONDITIONAL(service_state) if the account is suspended.

Narrative

Automation Account sandbox jobs expose the credentials of managed identity {target.name} to any code running in them via IMDS (http://169.254.169.254/metadata/identity/ oauth2/token); code execution in the sandbox = token access for {target.name}.

Raw rule rules/derived/azure/automation.yaml

id: azure-auto-exposes-mi-token
emits: ExposesCredential
description: An Automation Account sandbox job exposes its bound MI's token to any code it runs via the
  IMDS endpoint.
match:
- - runbook: null
  - ExecutesAs
  - identity: null
where:
- node_type(?runbook) == GenericCompute
- node_type(?identity) in [ManagedIdentity, ServiceIdentity]
- ?runbook is a runbook (BuildWorker) in an Automation Account (AutomationService)
emit:
  source_type: GenericCompute
  target_type: ManagedIdentity
  source: ?runbook
  target: ?identity
  permissions: []
  conditions: []
  state_logic: ACTIVE when the account has a bound MI (ExecutesAs confirmed) and a runbook can execute
    in the sandbox. CONDITIONAL(service_state) if the account is suspended.
  confidence: 1.0
  derived_from:
  - 'azure-auto-executes-as-mi: ?runbook ExecutesAs ?identity'
  - 'credential-chains.yaml: ExposesCredential feeds CanImpersonate via CredentialsFor'
  false_positive_note: This edge expresses the fact that code-execution in the sandbox equals holding
    the MI's credentials. It is not an escalation by itself; it becomes an attack step when combined with
    a CanModifyCode or CanTrigger edge. The IMDS endpoint is only reachable from within the sandbox; a
    principal who can only read ARM config cannot reach it without code execution.
  narrative: Automation Account sandbox jobs expose the credentials of managed identity {target.name}
    to any code running in them via IMDS (http://169.254.169.254/metadata/identity/ oauth2/token); code
    execution in the sandbox = token access for {target.name}.