rage.fail

azure-vm-imds-token

Any code on a VM can mint a bearer token for each bound managed identity via IMDS.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'vm': None} ExecutesAs {'mi': None}

emit

source	`<virtualMachine>`
target	`<managed identity bound to the VM>`

Narrative

Any code running on {vm.name} can request a bearer token for {mi.name} from IMDS (169.254.169.254) with no OS credential.

Raw rule rules/derived/azure/vm.yaml

id: azure-vm-imds-token
emits: CanRetrieveToken
description: Any code on a VM can mint a bearer token for each bound managed identity via IMDS.
match:
- - vm: null
  - ExecutesAs
  - mi: null
emit:
  source: <virtualMachine>
  target: <managed identity bound to the VM>
  permissions: []
  note: 'IMDS: GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=<aud>
    with header ''Metadata: true''. Arc: http://localhost:40342/... See azure-vm-imds-exposescred for
    the paired ExposesCredential(vm -> mi) fact.'
  false_positive_note: Only fires when the VM actually has a managed identity (identity.type != None).
    No MI => no token; do NOT emit.
  narrative: Any code running on {vm.name} can request a bearer token for {mi.name} from IMDS (169.254.169.254)
    with no OS credential.