rage.fail

azure-batch-node-imds-exposescred

A Batch pool that bears a user-assigned MI leaks that MI's credential to any code on its nodes via IMDS.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'pool': None} ExecutesAs {'mi': None}

emit

source	`<batch pool / node>`
target	`<user-assigned MI bound to the pool>`

Narrative

Batch pool {pool.name} exposes the credential of its user-assigned MI {mi.name} to any code running on its nodes (via IMDS).

Raw rule rules/derived/azure/batch.yaml

id: azure-batch-node-imds-exposescred
emits: ExposesCredential
description: A Batch pool that bears a user-assigned MI leaks that MI's credential to any code on its
  nodes via IMDS.
match:
- - pool: null
  - ExecutesAs
  - mi: null
emit:
  source: <batch pool / node>
  target: <user-assigned MI bound to the pool>
  permissions: []
  note: The pool exposes its MI credential to on-node code through IMDS; paired with azure-batch-node-imds-token
    (CanRetrieveToken) as the token-mint capability.
  false_positive_note: Only fires when the pool actually has a user-assigned MI (identity.type == UserAssigned).
    The account system-assigned MI (CMK) is NOT the node identity. No pool MI => do NOT emit.
  narrative: Batch pool {pool.name} exposes the credential of its user-assigned MI {mi.name} to any code
    running on its nodes (via IMDS).