rage.fail

azure-batch-node-imds-token

Any code on a Batch node can mint a bearer token for each pool user-assigned MI via IMDS.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'pool': None} ExecutesAs {'mi': None}

emit

source	`<batch pool / node>`
target	`<user-assigned MI bound to the pool>`

Narrative

Any task running on pool {pool.name} can request a bearer token for {mi.name} from IMDS (169.254.169.254) with no node credential.

Raw rule rules/derived/azure/batch.yaml

id: azure-batch-node-imds-token
emits: CanRetrieveToken
description: Any code on a Batch node can mint a bearer token for each pool user-assigned MI via IMDS.
match:
- - pool: null
  - ExecutesAs
  - mi: null
emit:
  source: <batch pool / node>
  target: <user-assigned MI bound to the pool>
  permissions: []
  note: 'IMDS: GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=<aud>
    with header ''Metadata: true''. The companion ExposesCredential(pool -> mi) edge is emitted by azure-batch-node-imds-exposescred.'
  false_positive_note: Only fires when the pool actually has a user-assigned MI (identity.type == UserAssigned).
    The account system-assigned MI (CMK) is NOT the node identity. No pool MI => no token; do NOT emit.
  narrative: Any task running on pool {pool.name} can request a bearer token for {mi.name} from IMDS (169.254.169.254)
    with no node credential.