azure-la-identity-endpoint-exposescred

A Standard Logic App with a bound MI exposes that MI's credential to any code/action running in the app.

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Standard Logic App site>`
target	`<managed identity bound to the workflow>`
state logic	ACTIVE when MI is confirmed present. Not emitted for Consumption Logic Apps.

source type

Compute

target type

Identity

source

<Standard Logic App site>

target

<managed identity bound to the workflow>

state logic

ACTIVE when MI is confirmed present. Not emitted for Consumption Logic Apps.

Narrative

Standard Logic App {app.name} exposes the credential of its managed identity {mi.name} to any code or workflow action running in the app (App Service identity endpoint).

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-identity-endpoint-exposescred
emits: ExposesCredential
description: A Standard Logic App with a bound MI exposes that MI's credential to any code/action running
  in the app.
match:
- - app: null
  - ExecutesAs
  - mi: null
where:
- node_type(?app) in [Workflow, ApplicationPlatform]
- ?app is a Standard (single-tenant) Logic App (kind=workflowapp on Microsoft.Web/sites)
emit:
  source_type: Compute
  target_type: Identity
  source: <Standard Logic App site>
  target: <managed identity bound to the workflow>
  permissions: []
  conditions: []
  state_logic: ACTIVE when MI is confirmed present. Not emitted for Consumption Logic Apps.
  confidence: 0.95
  derived_from:
  - '<ExecutesAs edge: ?app -> ?mi>'
  false_positive_note: "Only fires for Standard Logic Apps with a managed identity. Companion to azure-la-identity-endpoint-token.\
    \ For Consumption Logic Apps, the token is obtained via the internal Managed Identity token relay\
    \ (HTTP action to the managed identity token endpoint), NOT IDENTITY_ENDPOINT \u2014 emit ExposesCredential\
    \ separately for Consumption only if the workflow definition includes an explicit HTTP action calling\
    \ the token relay (evidence-dependent)."
  narrative: Standard Logic App {app.name} exposes the credential of its managed identity {mi.name} to
    any code or workflow action running in the app (App Service identity endpoint).