azure-mi-imds-token-node-create

Synthesize an IMDS bearer token node for each host+MI pair where the host executes as the MI.

derived azure emits LocatedIn

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Token`
target type	`AdministrativeBoundary`
source	`<synthetic IMDS Token node: azure:sub:Token:imds-<host-id>-<mi-id>>`
target	`<resource group or region containing ?host>`
state logic	ACTIVE when the host ExecutesAs the MI (the structural fact exists). The synthetic node inherits the service_state from ?host; token is only mintable when the host is running.

source type

Token

target type

AdministrativeBoundary

source

<synthetic IMDS Token node: azure:sub:Token:imds-<host-id>-<mi-id>>

target

<resource group or region containing ?host>

state logic

ACTIVE when the host ExecutesAs the MI (the structural fact exists). The synthetic node inherits the service_state from ?host; token is only mintable when the host is running.

Narrative

Synthetic IMDS bearer token node created for managed identity {mi.name} accessible from host {host.name} in {target.name}. This token is the credential object that sources the CredentialsFor edge to {mi.name}.

Raw rule rules/derived/azure/managedidentity.yaml

id: azure-mi-imds-token-node-create
emits: LocatedIn
description: Synthesize an IMDS bearer token node for each host+MI pair where the host executes as the
  MI.
applies_to:
- azure
match:
- - host: null
  - ExecutesAs
  - mi: null
where:
- node_type(?mi) == ManagedIdentity
- node_class(?host) == Compute
emit:
  source_type: Token
  target_type: AdministrativeBoundary
  source: '<synthetic IMDS Token node: azure:sub:Token:imds-<host-id>-<mi-id>>'
  target: <resource group or region containing ?host>
  permissions: []
  conditions: []
  state_logic: ACTIVE when the host ExecutesAs the MI (the structural fact exists). The synthetic node
    inherits the service_state from ?host; token is only mintable when the host is running.
  confidence: 0.99
  derived_from:
  - ?host ExecutesAs ?mi
  false_positive_note: Create one Token node per (host, MI) pair. If the same host ExecutesAs multiple
    MIs (e.g., multiple user-assigned MIs), create a separate token node for each. The token node's native_id
    should encode both host and MI.
  narrative: Synthetic IMDS bearer token node created for managed identity {mi.name} accessible from host
    {host.name} in {target.name}. This token is the credential object that sources the CredentialsFor
    edge to {mi.name}.