rage.fail

azure-synapse-imds-token

Any code running on Synapse Spark/pipeline compute can mint a bearer token for the workspace MI via IMDS.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'workspace': None} ExecutesAs {'mi': None}

where

node_type(?workspace) == AnalyticsService node_type(?mi) == ManagedIdentity

emit

source type	`Compute`
target type	`Identity`
source	`<Synapse Spark pool / pipeline compute in the workspace>`
target	`<workspace managed identity>`

Narrative

Any code executing in Synapse workspace {workspace.name} (Spark job, pipeline, notebook) can retrieve a bearer token for workspace MI {mi.name} from IMDS.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-imds-token
emits: CanRetrieveToken
description: Any code running on Synapse Spark/pipeline compute can mint a bearer token for the workspace
  MI via IMDS.
match:
- - workspace: null
  - ExecutesAs
  - mi: null
where:
- node_type(?workspace) == AnalyticsService
- node_type(?mi) == ManagedIdentity
emit:
  source_type: Compute
  target_type: Identity
  source: <Synapse Spark pool / pipeline compute in the workspace>
  target: <workspace managed identity>
  permissions: []
  schema_note: 'AnalyticsService is classified as a Data node (not Compute) in nodes.yaml. CanRetrieveToken''s
    source constraint is [Identity, Compute, WorkloadIdentity]. AnalyticsService does not appear in that
    set. This rule violates the source type constraint. A schema extension request has been filed to add
    AnalyticsService to CanRetrieveToken''s allowed source types, as AnalyticsService nodes are legitimate
    execution surfaces that can retrieve tokens via IMDS. See issue: TS-2847.'
  false_positive_note: Only fires when the workspace has a system-assigned or user-assigned MI. The token
    is retrievable from any Spark executor, pipeline compute, or notebook kernel on the workspace. This
    is a fact edge; the attack value comes from combining it with CanModifyCode/CanTrigger/CanExecuteCommand
    capabilities.
  narrative: Any code executing in Synapse workspace {workspace.name} (Spark job, pipeline, notebook)
    can retrieve a bearer token for workspace MI {mi.name} from IMDS.