azure-mi-token-credentials-for

id: azure-mi-token-credentials-for
emits: CredentialsFor
description: An IMDS bearer token minted from a host+MI pair is valid authentication as that MI.
applies_to:
- azure
match:
- - token: null
  - LocatedIn
  - boundary: null
- - host: null
  - ExecutesAs
  - mi: null
where:
- node_type(?token) == Token
- node_name(?token) matches 'imds-.*'
- extract_host_id(?token) == node_id(?host)
- extract_mi_id(?token) == node_id(?mi)
- node_type(?mi) == ManagedIdentity
- node_class(?host) == Compute
emit:
  source_type: Token
  target_type: ManagedIdentity
  source: ?token
  target: ?mi
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE when the host is running and has the MI binding; the token can be minted at any
    time while the host is up. CONDITIONAL(service_state) when the host is stopped/deallocated.
  confidence: 0.99
  derived_from:
  - ?host ExecutesAs ?mi
  - ?token LocatedIn ?boundary (synthetic IMDS token)
  false_positive_note: Do NOT emit CredentialsFor if the host is not actually running (check ?host.state
    == 'running' for ACTIVE emission). The token is renewable and short-lived (default 1 hour). It authenticates
    as the MI only against Azure APIs the MI is authorized on; a credential-chains query will compose
    this with the MI's RBAC to determine downstream privilege paths.
  narrative: The bearer token minted from IMDS for {mi.name} on {host.name} is valid authentication as
    {mi.name} against any Azure API that {mi.name} is authorized on. Any principal who can execute code
    on {host.name} or read the cached token can then authenticate as {mi.name}.