azure-vm-execute-as-via-command

Command/code execution on a VM + the VM runs as an MI => execute as that MI (via IMDS).

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<managed identity>`
permissions	`Microsoft.Compute/virtualMachines/runCommand/action \| extensions/write \| login data action`
state logic	if ?vm running: ACTIVE elif matched(optional[0]): CONDITIONAL(service_state) # CanStart realizes it, but starting is an action that may itself be gated (deny assignment, quota, boot time) else: CONDITIONAL(service_state)

source type

Identity

target type

Identity

source

<principal>

target

<managed identity>

permissions

Microsoft.Compute/virtualMachines/runCommand/action | extensions/write | login data action

state logic

if ?vm running: ACTIVE elif matched(optional[0]): CONDITIONAL(service_state) # CanStart realizes it, but starting is an action that may itself be gated (deny assignment, quota, boot time) else: CONDITIONAL(service_state)

Narrative

{principal.name} can execute code on {vm.name} (runCommand/extension/login) and mint the token of its identity {mi.name} from IMDS, executing as {mi.name}.

Raw rule rules/derived/azure/vm.yaml

id: azure-vm-execute-as-via-command
emits: CanExecuteAs
description: Command/code execution on a VM + the VM runs as an MI => execute as that MI (via IMDS).
match:
- - principal: null
  - CanExecuteCommand
  - vm: null
- - vm: null
  - ExecutesAs
  - mi: null
where:
- node_type(?vm) == VirtualMachine
- '?mi.privilege_level >= ?principal.privilege_level   # escalation only'
optional:
- - principal: null
  - CanStart
  - vm: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <managed identity>
  state_logic: 'if ?vm running: ACTIVE

    elif matched(optional[0]): CONDITIONAL(service_state)   # CanStart realizes it, but starting is an
    action that may itself be gated (deny assignment, quota, boot time)

    else: CONDITIONAL(service_state)

    '
  conditions_from:
  - vm: null
  - mi: null
  permissions:
  - Microsoft.Compute/virtualMachines/runCommand/action | extensions/write | login data action
  derived_from:
  - <CanExecuteCommand edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: Emit only when the VM has a managed identity and that MI out-privileges the caller.
    On a stopped VM without CanStart -> CONDITIONAL(service_state).
  narrative: '{principal.name} can execute code on {vm.name} (runCommand/extension/login) and mint the
    token of its identity {mi.name} from IMDS, executing as {mi.name}.'