rage.fail

azure-vmss-imds-token

Any code-exec primitive on a fleet that has an MI yields that MI's token from IMDS.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'vmss_instance': None} ExecutesAs {'mi': None}

where

?principal has code execution on the instance/fleet (CanExecuteCommand OR CanModifyCode)

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} CanExecuteCommand {'vmss_instance': None} {'principal': None} CanModifyCode {'vmss': None}

emit

source	`<principal / instance>`
target	`<managed identity>`
permissions	`(in-guest) GET http://169.254.169.254/metadata/identity/oauth2/token`
conditions	`service_state`

Narrative

{principal.name} can retrieve a token for managed identity {mi.name} from IMDS on {vmss.name} instances.

Raw rule rules/derived/azure/vmss.yaml

id: azure-vmss-imds-token
emits: CanRetrieveToken
description: Any code-exec primitive on a fleet that has an MI yields that MI's token from IMDS.
match:
- - vmss_instance: null
  - ExecutesAs
  - mi: null
optional:
- - principal: null
  - CanExecuteCommand
  - vmss_instance: null
- - principal: null
  - CanModifyCode
  - vmss: null
where:
- ?principal has code execution on the instance/fleet (CanExecuteCommand OR CanModifyCode)
emit:
  source: <principal / instance>
  target: <managed identity>
  permissions:
  - (in-guest) GET http://169.254.169.254/metadata/identity/oauth2/token
  conditions:
  - service_state
  note: IMDS is link-local, credential-free, reachable from any running instance.
  false_positive_note: Only emit when the fleet actually has a managed identity (ExecutesAs present) AND
    the principal has an execution primitive; no MI => no token payoff.
  narrative: '{principal.name} can retrieve a token for managed identity {mi.name} from IMDS on {vmss.name}
    instances.'