rage.fail

azure-dbx-cluster-imds-token

Any code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'cluster': None} ExecutesAs {'mi': None}

where

node_type(?cluster) in [BatchJob, GenericCompute] node_type(?mi) in [ManagedIdentity, ServiceIdentity]

emit

source	`<Databricks Cluster>`
target	`<managed identity (ManagedIdentity)>`

Narrative

Any task running on cluster {source.name} can request a bearer token for MI {target.name} from IMDS (169.254.169.254), obtaining ARM credentials with no additional authentication.

Raw rule rules/derived/azure/databricks.yaml

id: azure-dbx-cluster-imds-token
emits: CanRetrieveToken
description: Any code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.
match:
- - cluster: null
  - ExecutesAs
  - mi: null
where:
- node_type(?cluster) in [BatchJob, GenericCompute]
- node_type(?mi) in [ManagedIdentity, ServiceIdentity]
emit:
  source: <Databricks Cluster>
  target: <managed identity (ManagedIdentity)>
  permissions: []
  note: 'GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01 &resource=https://management.azure.com/
    with header ''Metadata: true''. Works for any Azure resource audience. The companion ExposesCredential
    fact is emitted by azure-dbx-cluster-imds-exposescred.'
  false_positive_note: Only fires when the cluster actually has a bound MI via Access Connector or cluster-level
    MI configuration. No bound MI -> do NOT emit.
  derived_from:
  - <ExecutesAs edge_id>
  narrative: Any task running on cluster {source.name} can request a bearer token for MI {target.name}
    from IMDS (169.254.169.254), obtaining ARM credentials with no additional authentication.