azure-la-identity-endpoint-token

Code/actions in a Standard Logic App can mint a bearer token for each bound MI via the App Service identity endpoint.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Standard Logic App site>`
target	`<managed identity bound to the workflow>`
state logic	ACTIVE when the Standard Logic App has a managed identity (identity.type != None) and is running. Not emitted for Consumption Logic Apps (they use an internal token relay not the App Service IDENTITY_ENDPOINT/IDENTITY_HEADER; the Consumption identity is still accessible via workflow HTTP actions but the endpoint differs).

source type

Compute

target type

Identity

source

<Standard Logic App site>

target

<managed identity bound to the workflow>

state logic

ACTIVE when the Standard Logic App has a managed identity (identity.type != None) and is running. Not emitted for Consumption Logic Apps (they use an internal token relay not the App Service IDENTITY_ENDPOINT/IDENTITY_HEADER; the Consumption identity is still accessible via workflow HTTP actions but the endpoint differs).

Narrative

Any code or workflow action in Standard Logic App {app.name} can request a bearer token for managed identity {mi.name} from the App Service identity endpoint (IDENTITY_ENDPOINT/IDENTITY_HEADER), no app secret required.

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-identity-endpoint-token
emits: CanRetrieveToken
description: Code/actions in a Standard Logic App can mint a bearer token for each bound MI via the App
  Service identity endpoint.
match:
- - app: null
  - ExecutesAs
  - mi: null
where:
- node_type(?app) in [Workflow, ApplicationPlatform]
- ?app is a Standard (single-tenant) Logic App (kind=workflowapp on Microsoft.Web/sites)
emit:
  source_type: Compute
  target_type: Identity
  source: <Standard Logic App site>
  target: <managed identity bound to the workflow>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the Standard Logic App has a managed identity (identity.type != None) and is
    running. Not emitted for Consumption Logic Apps (they use an internal token relay not the App Service
    IDENTITY_ENDPOINT/IDENTITY_HEADER; the Consumption identity is still accessible via workflow HTTP
    actions but the endpoint differs).
  confidence: 0.95
  derived_from:
  - '<ExecutesAs edge: ?app -> ?mi>'
  false_positive_note: 'Only fires when the app actually has a managed identity. For Standard Logic Apps,
    the App Service identity endpoint (%IDENTITY_ENDPOINT%?resource=<aud>&api-version=2019-08-01 with
    header X-IDENTITY-HEADER: %IDENTITY_HEADER%) is the mechanism; this is NOT the 169.254 IMDS used by
    VMs. If the workflow has no MI, do NOT emit.'
  narrative: Any code or workflow action in Standard Logic App {app.name} can request a bearer token for
    managed identity {mi.name} from the App Service identity endpoint (IDENTITY_ENDPOINT/IDENTITY_HEADER),
    no app secret required.