rage.fail

azure-func-identity-endpoint-exposescred

A Function app with a bound MI leaks that MI's credential to any code running in the app via the App Service identity endpoint.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'app': None} ExecutesAs {'mi': None}

emit

source	`<function app>`
target	`<managed identity bound to the app>`

Narrative

Function app {app.name} exposes the credential of its managed identity {mi.name} to any code running in the app (App Service identity endpoint).

Raw rule rules/derived/azure/functions.yaml

id: azure-func-identity-endpoint-exposescred
emits: ExposesCredential
description: A Function app with a bound MI leaks that MI's credential to any code running in the app
  via the App Service identity endpoint.
match:
- - app: null
  - ExecutesAs
  - mi: null
emit:
  source: <function app>
  target: <managed identity bound to the app>
  permissions: []
  note: The identity endpoint (IDENTITY_ENDPOINT/IDENTITY_HEADER) makes the bound MI's token reachable
    from app code; this is the leak fact paired with azure-func-identity-endpoint-token (the token-mint
    capability).
  false_positive_note: Only fires when the app actually has a managed identity (identity.type != None).
    No MI => no exposure; do NOT emit.
  narrative: Function app {app.name} exposes the credential of its managed identity {mi.name} to any code
    running in the app (App Service identity endpoint).