azure-mi-read
Principal with read permission on the MI ARM resource can enumerate its metadata (clientId, principalId, tenantId) - recon aiding IMDS multi-MI token requests.
match (effective permission)
{
"action": "Microsoft.ManagedIdentity/userAssignedIdentities/read",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | ManagedIdentity |
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/read |
| state logic | ACTIVE when the principal holds the read permission at scope. CONDITIONAL(iam_permission) when the assignment is PIM-eligible-not-activated. BLOCKED when a deny assignment suppresses the read action. |
Narrative
{principal.name} can read the metadata of managed identity {target.name} (clientId, principalId, tenantId) - recon that aids IMDS token requests when multiple user-assigned MIs are attached to a host.
Raw rule rules/explicit/azure-managedidentity.yaml
id: azure-mi-read
emits: CanRead
applies_to:
- azure
description: "Principal with read permission on the MI ARM resource can enumerate its metadata (clientId,\
\ principalId, tenantId) \u2014 recon aiding IMDS multi-MI token requests."
match_effective_permission:
action: Microsoft.ManagedIdentity/userAssignedIdentities/read
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: ManagedIdentity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/read
conditions: []
state_logic: ACTIVE when the principal holds the read permission at scope. CONDITIONAL(iam_permission)
when the assignment is PIM-eligible-not-activated. BLOCKED when a deny assignment suppresses the read
action.
confidence: 0.9
narrative: "{principal.name} can read the metadata of managed identity {target.name} (clientId, principalId,\
\ tenantId) \u2014 recon that aids IMDS token requests when multiple user-assigned MIs are attached\
\ to a host."
false_positive_note: Reading MI metadata (clientId, principalId, tenantId) is a recon capability that
aids lateral movement (the clientId is needed to specify which MI token to mint when multiple are
attached). It is not itself an escalation edge. CanRead is walkable but low-value (base_weight 2).