rage.fail

azure-vmss-exposes-credential

derived azure emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'vmss': None} ExecutesAs {'mi': None}

emit

source	`<scale set>`
target	`<managed identity>`

Narrative

{vmss.name} exposes managed-identity {mi.name} credentials to code on its instances.

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-exposes-credential
emits: ExposesCredential
match:
- - vmss: null
  - ExecutesAs
  - mi: null
emit:
  source: <scale set>
  target: <managed identity>
  note: The fleet exposes the MI credential to any code running on its instances (via IMDS).
  narrative: '{vmss.name} exposes managed-identity {mi.name} credentials to code on its instances.'