rage.fail

azure-batch-execute-as-via-sharedkey

Shared key -> data-plane task submit on an identity-bearing pool => execute as the pool MI.

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanReadSecret {'keys': None} {'pool': None} ExecutesAs {'mi': None}

where

node_type(?keys) == AccessKey # Batch account shared keys ?keys and ?pool belong to the same Batch account ?mi.privilege_level >= ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<user-assigned managed identity>`
permissions	`Microsoft.Batch/batchAccounts/listkeys/action`
state logic	if ?pool has active nodes: ACTIVE else: CONDITIONAL(service_state)

Narrative

{principal.name} can retrieve the shared keys of the Batch account (listkeys) and submit a task to identity-bearing pool {pool.name}, executing as its MI {mi.name} via IMDS.

Raw rule rules/derived/azure/batch.yaml

id: azure-batch-execute-as-via-sharedkey
emits: CanExecuteAs
description: Shared key -> data-plane task submit on an identity-bearing pool => execute as the pool MI.
match:
- - principal: null
  - CanReadSecret
  - keys: null
- - pool: null
  - ExecutesAs
  - mi: null
where:
- 'node_type(?keys) == AccessKey  # Batch account shared keys'
- ?keys and ?pool belong to the same Batch account
- ?mi.privilege_level >= ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <user-assigned managed identity>
  state_logic: 'if ?pool has active nodes: ACTIVE

    else: CONDITIONAL(service_state)

    '
  conditions_from:
  - pool: null
  - mi: null
  permissions:
  - Microsoft.Batch/batchAccounts/listkeys/action
  derived_from:
  - <CanReadSecret edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: Only when the shared key belongs to the SAME account as an identity-bearing pool.
    The key cannot create/modify the pool identity; it only submits tasks into a pool that already has
    an MI.
  narrative: '{principal.name} can retrieve the shared keys of the Batch account (listkeys) and submit
    a task to identity-bearing pool {pool.name}, executing as its MI {mi.name} via IMDS.'