rage.fail

azure-dbx-cluster-imds-exposescred

A cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'cluster': None} ExecutesAs {'mi': None}

where

node_type(?cluster) in [BatchJob, GenericCompute] node_type(?mi) in [ManagedIdentity, ServiceIdentity]

emit

source	`<Databricks Cluster>`
target	`<managed identity (ManagedIdentity)>`

Narrative

Databricks cluster {source.name} exposes the credential of its managed identity {target.name} to any code running on the cluster via IMDS (169.254.169.254).

Raw rule rules/derived/azure/databricks.yaml

id: azure-dbx-cluster-imds-exposescred
emits: ExposesCredential
description: A cluster with a bound Access Connector MI leaks that MI's credential to any code running
  on it via IMDS.
match:
- - cluster: null
  - ExecutesAs
  - mi: null
where:
- node_type(?cluster) in [BatchJob, GenericCompute]
- node_type(?mi) in [ManagedIdentity, ServiceIdentity]
emit:
  source: <Databricks Cluster>
  target: <managed identity (ManagedIdentity)>
  permissions: []
  note: 'Cluster code calls IMDS at 169.254.169.254/metadata/identity/oauth2/token with Metadata: true
    header to obtain an ARM bearer token for the bound MI. This is the leak fact; CanRetrieveToken (azure-dbx-cluster-imds-token)
    is the capability.'
  false_positive_note: Only fires when the cluster actually has a bound MI (Access Connector MI or cluster-level
    user-assigned MI). No MI -> do NOT emit. The system-assigned MI of the workspace's managed resource
    group is NOT automatically available to cluster code; only the configured Access Connector MI is.
  derived_from:
  - <ExecutesAs edge_id>
  narrative: Databricks cluster {source.name} exposes the credential of its managed identity {target.name}
    to any code running on the cluster via IMDS (169.254.169.254).