azure-auto-imds-token
Code executing in an Automation Account sandbox can retrieve a bearer token for the bound MI from IMDS.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?identity is a
ManagedIdentity bound to an Automation Account (AutomationService)
?principal reached ?identity via an azure-auto-* derivation (code runs in the Automation sandbox)
emit
| source type | Identity |
|---|---|
| target type | ManagedIdentity |
| source | ?principal |
| target | ?identity |
Narrative
{principal.name}, executing code in an Automation Account sandbox as {identity.name}, can retrieve the MI's bearer token from IMDS (http://169.254.169.254/metadata/identity/ oauth2/token) without any further credential.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-imds-token
emits: CanRetrieveToken
description: Code executing in an Automation Account sandbox can retrieve a bearer token for the bound
MI from IMDS.
match:
- - principal: null
- CanExecuteAs
- identity: null
where:
- ?identity is a ManagedIdentity bound to an Automation Account (AutomationService)
- ?principal reached ?identity via an azure-auto-* derivation (code runs in the Automation sandbox)
emit:
source_type: Identity
target_type: ManagedIdentity
source: ?principal
target: ?identity
permissions: []
derived_from:
- <CanExecuteAs edge for ?principal -> ?identity via Automation sandbox>
- 'cicd-chains.yaml: cicd-modify-buildspec-executes-as or cicd-trigger-runner-executes-as'
false_positive_note: "Redundant with CanExecuteAs for path-finding; emitted so credential-centric queries\
\ surface the token-retrieval step explicitly. State inherits from the contributing CanExecuteAs edge.\
\ Only emit when CanExecuteAs was derived via an Automation sandbox (not a hybrid worker \u2014 hybrid\
\ worker RCE yields CanExecuteCommand/CanExecuteAs via can-execute-as execute-as-via-command, with\
\ IMDS on the worker VM's own identity)."
narrative: '{principal.name}, executing code in an Automation Account sandbox as {identity.name}, can
retrieve the MI''s bearer token from IMDS (http://169.254.169.254/metadata/identity/ oauth2/token)
without any further credential.'