rage.fail

azure-func-identity-endpoint-token

Any code in a Function app can mint a bearer token for each bound MI via the App Service identity endpoint.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'app': None} ExecutesAs {'mi': None}

emit

source	`<function app>`
target	`<managed identity bound to the app>`

Narrative

Any code running in {app.name} can request a bearer token for {mi.name} from the App Service identity endpoint (IDENTITY_ENDPOINT/IDENTITY_HEADER), no app secret required.

Raw rule rules/derived/azure/functions.yaml

id: azure-func-identity-endpoint-token
emits: CanRetrieveToken
description: Any code in a Function app can mint a bearer token for each bound MI via the App Service
  identity endpoint.
match:
- - app: null
  - ExecutesAs
  - mi: null
emit:
  source: <function app>
  target: <managed identity bound to the app>
  permissions: []
  note: 'GET %IDENTITY_ENDPOINT%?resource=<aud>&api-version=2019-08-01 with header X-IDENTITY-HEADER:
    %IDENTITY_HEADER%. NOT the 169.254 IMDS. Companion rule azure-func-identity-endpoint-exposescred emits
    the ExposesCredential(app -> mi) leak fact.'
  false_positive_note: Only fires when the app actually has a managed identity (identity.type != None).
    No MI => no token; do NOT emit.
  narrative: Any code running in {app.name} can request a bearer token for {mi.name} from the App Service
    identity endpoint (IDENTITY_ENDPOINT/IDENTITY_HEADER), no app secret required.